24c295f9e5772296c5509f68ddcc2112d13097889d577bd61fb36420d1a21d60

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11666942f62a691def772cf36b512f6d.exe
Size

24KB
MD5

11666942f62a691def772cf36b512f6d
SHA1

615b52e6e07bca094f778a385e170aac54937706
SHA256

24c295f9e5772296c5509f68ddcc2112d13097889d577bd61fb36420d1a21d60
SHA512

3fb4b337a3d6211aa083d862bb287aa1e2c7578efb06346db4c22a3ee24106d61b4e39a5d25ec9cf4c300b6e26210defe256c402832e3d23efdd4e9a4003aa7b
SSDEEP

384:E3eVES+/xwGkRKJ4fIKVlM61qmTTMVF9/q5P0:bGS+ZfbJ0VO8qYoAs

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	11666942f62a691def772cf36b512f6d.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	11666942f62a691def772cf36b512f6d.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2272	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1984	ipconfig.exe
2612	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	tasklist.exe
Token: SeDebugPrivilege	2612	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1888	11666942f62a691def772cf36b512f6d.exe
1888	11666942f62a691def772cf36b512f6d.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2548	1888	11666942f62a691def772cf36b512f6d.exe	28
PID 1888 wrote to memory of 2548	1888	11666942f62a691def772cf36b512f6d.exe	28
PID 1888 wrote to memory of 2548	1888	11666942f62a691def772cf36b512f6d.exe	28
PID 1888 wrote to memory of 2548	1888	11666942f62a691def772cf36b512f6d.exe	28
PID 2548 wrote to memory of 2992	2548	cmd.exe	30
PID 2548 wrote to memory of 2992	2548	cmd.exe	30
PID 2548 wrote to memory of 2992	2548	cmd.exe	30
PID 2548 wrote to memory of 2992	2548	cmd.exe	30
PID 2548 wrote to memory of 1984	2548	cmd.exe	31
PID 2548 wrote to memory of 1984	2548	cmd.exe	31
PID 2548 wrote to memory of 1984	2548	cmd.exe	31
PID 2548 wrote to memory of 1984	2548	cmd.exe	31
PID 2548 wrote to memory of 2272	2548	cmd.exe	32
PID 2548 wrote to memory of 2272	2548	cmd.exe	32
PID 2548 wrote to memory of 2272	2548	cmd.exe	32
PID 2548 wrote to memory of 2272	2548	cmd.exe	32
PID 2548 wrote to memory of 2728	2548	cmd.exe	34
PID 2548 wrote to memory of 2728	2548	cmd.exe	34
PID 2548 wrote to memory of 2728	2548	cmd.exe	34
PID 2548 wrote to memory of 2728	2548	cmd.exe	34
PID 2728 wrote to memory of 2684	2728	net.exe	35
PID 2728 wrote to memory of 2684	2728	net.exe	35
PID 2728 wrote to memory of 2684	2728	net.exe	35
PID 2728 wrote to memory of 2684	2728	net.exe	35
PID 2548 wrote to memory of 2612	2548	cmd.exe	36
PID 2548 wrote to memory of 2612	2548	cmd.exe	36
PID 2548 wrote to memory of 2612	2548	cmd.exe	36
PID 2548 wrote to memory of 2612	2548	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\11666942f62a691def772cf36b512f6d.exe
"C:\Users\Admin\AppData\Local\Temp\11666942f62a691def772cf36b512f6d.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2992
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1984
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2684
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
3a7adbc7f2ba1f18b4774ff011c90858

SHA1
9edfb50ee945809cb6cb6bfc2341b978e595bce1

SHA256
26361317642c8d032f5fc5e612c529a2fa625868ba2ee210aa6d0ad736789090

SHA512
94756045718b48332f53e7464996f1953a853b644e0eb74908de2bc0acc1162c88e4bcf79e991273398665a3ae88c3bf72d56557e548539df37231363fb71947

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads