3cf82a4f1bd29d5032c08ac9cb9e32bb66afb4a8b24a61b84f04a3466bf18ca2

Analysis

max time kernel
2s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12c9743e833d831fe2a6803d03a69ae2.exe
Size

24KB
MD5

12c9743e833d831fe2a6803d03a69ae2
SHA1

c881abbfa2b0d448234fbc9f547f88cd33191d1a
SHA256

3cf82a4f1bd29d5032c08ac9cb9e32bb66afb4a8b24a61b84f04a3466bf18ca2
SHA512

43470d9a14742acf503524cf2ff4b6d0f9a6e803ec1d8569952f4420dc63f759d4b400d04e523eaa2764805cd483bbd64662eba74f1e7682512007bc3fd355a5
SSDEEP

384:E3eVES+/xwGkRKJD2YlM61qmTTMVF9/q5k0:bGS+ZfbJ/O8qYoAF

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	12c9743e833d831fe2a6803d03a69ae2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	12c9743e833d831fe2a6803d03a69ae2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2872	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2688	ipconfig.exe
2784	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	tasklist.exe
Token: SeDebugPrivilege	2784	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2024	12c9743e833d831fe2a6803d03a69ae2.exe
2024	12c9743e833d831fe2a6803d03a69ae2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2328	2024	12c9743e833d831fe2a6803d03a69ae2.exe	25
PID 2024 wrote to memory of 2328	2024	12c9743e833d831fe2a6803d03a69ae2.exe	25
PID 2024 wrote to memory of 2328	2024	12c9743e833d831fe2a6803d03a69ae2.exe	25
PID 2024 wrote to memory of 2328	2024	12c9743e833d831fe2a6803d03a69ae2.exe	25
PID 2328 wrote to memory of 2720	2328	cmd.exe	30
PID 2328 wrote to memory of 2720	2328	cmd.exe	30
PID 2328 wrote to memory of 2720	2328	cmd.exe	30
PID 2328 wrote to memory of 2720	2328	cmd.exe	30
PID 2328 wrote to memory of 2688	2328	cmd.exe	31
PID 2328 wrote to memory of 2688	2328	cmd.exe	31
PID 2328 wrote to memory of 2688	2328	cmd.exe	31
PID 2328 wrote to memory of 2688	2328	cmd.exe	31
PID 2328 wrote to memory of 2872	2328	cmd.exe	32
PID 2328 wrote to memory of 2872	2328	cmd.exe	32
PID 2328 wrote to memory of 2872	2328	cmd.exe	32
PID 2328 wrote to memory of 2872	2328	cmd.exe	32
PID 2328 wrote to memory of 2864	2328	cmd.exe	34
PID 2328 wrote to memory of 2864	2328	cmd.exe	34
PID 2328 wrote to memory of 2864	2328	cmd.exe	34
PID 2328 wrote to memory of 2864	2328	cmd.exe	34
PID 2864 wrote to memory of 2924	2864	net.exe	35
PID 2864 wrote to memory of 2924	2864	net.exe	35
PID 2864 wrote to memory of 2924	2864	net.exe	35
PID 2864 wrote to memory of 2924	2864	net.exe	35
PID 2328 wrote to memory of 2784	2328	cmd.exe	36
PID 2328 wrote to memory of 2784	2328	cmd.exe	36
PID 2328 wrote to memory of 2784	2328	cmd.exe	36
PID 2328 wrote to memory of 2784	2328	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\12c9743e833d831fe2a6803d03a69ae2.exe
"C:\Users\Admin\AppData\Local\Temp\12c9743e833d831fe2a6803d03a69ae2.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2688
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2924
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
1KB

MD5
c44ab5137a283e81033e5409df31130c

SHA1
ee9d49831f51c305b4a961fdfcbdc1074064a6f1

SHA256
0ec11a5a816a735216de44d08e0c601aaf24e3274742d2a8d2fd5845e10daea2

SHA512
9d55a02cf2c857e6955188dd8aa3b272196ac3868a9bc72e6f942f61b77c047f0bbcd9a6446e291bfad41bce4ebdf28e4e9fe252466a76415ec9f42591c73f8f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads