3cf82a4f1bd29d5032c08ac9cb9e32bb66afb4a8b24a61b84f04a3466bf18ca2

Analysis

max time kernel
0s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:57

Target

12c9743e833d831fe2a6803d03a69ae2.exe
Size

24KB
MD5

12c9743e833d831fe2a6803d03a69ae2
SHA1

c881abbfa2b0d448234fbc9f547f88cd33191d1a
SHA256

3cf82a4f1bd29d5032c08ac9cb9e32bb66afb4a8b24a61b84f04a3466bf18ca2
SHA512

43470d9a14742acf503524cf2ff4b6d0f9a6e803ec1d8569952f4420dc63f759d4b400d04e523eaa2764805cd483bbd64662eba74f1e7682512007bc3fd355a5
SSDEEP

384:E3eVES+/xwGkRKJD2YlM61qmTTMVF9/q5k0:bGS+ZfbJ/O8qYoAF

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	12c9743e833d831fe2a6803d03a69ae2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	12c9743e833d831fe2a6803d03a69ae2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
3440	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
1280	ipconfig.exe
1992	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3020	12c9743e833d831fe2a6803d03a69ae2.exe
3020	12c9743e833d831fe2a6803d03a69ae2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2400	3020	12c9743e833d831fe2a6803d03a69ae2.exe	29
PID 3020 wrote to memory of 2400	3020	12c9743e833d831fe2a6803d03a69ae2.exe	29
PID 3020 wrote to memory of 2400	3020	12c9743e833d831fe2a6803d03a69ae2.exe	29
PID 2400 wrote to memory of 1324	2400	cmd.exe	28
PID 2400 wrote to memory of 1324	2400	cmd.exe	28
PID 2400 wrote to memory of 1324	2400	cmd.exe	28
PID 2400 wrote to memory of 1280	2400	cmd.exe	19
PID 2400 wrote to memory of 1280	2400	cmd.exe	19
PID 2400 wrote to memory of 1280	2400	cmd.exe	19
PID 2400 wrote to memory of 3440	2400	cmd.exe	27
PID 2400 wrote to memory of 3440	2400	cmd.exe	27
PID 2400 wrote to memory of 3440	2400	cmd.exe	27

C:\Users\Admin\AppData\Local\Temp\12c9743e833d831fe2a6803d03a69ae2.exe
"C:\Users\Admin\AppData\Local\Temp\12c9743e833d831fe2a6803d03a69ae2.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2400