cfe8a218c3bcb9e7ced3ea1a7a3f8cf96719f22fb24cf419d9af1ea6a616cb4d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1635a477c00f682bfc7b111d7f584092.exe
Size

24KB
MD5

1635a477c00f682bfc7b111d7f584092
SHA1

141a1a8fa7d430750363a00e0960c47c2f39c053
SHA256

cfe8a218c3bcb9e7ced3ea1a7a3f8cf96719f22fb24cf419d9af1ea6a616cb4d
SHA512

d182da75065d1f1df0a6d0f2e9b89230c950f32b0b5457e197cae744bae334b432cec74ee7f39c89ebaf52c06220ddb2ee987a3292ed246d1a2e96c6c7414f74
SSDEEP

384:E3eVES+/xwGkRKJ7W+qMAqQWlM61qmTTMVF9/q5E0:bGS+ZfbJ2qQWO8qYoAl

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	1635a477c00f682bfc7b111d7f584092.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	1635a477c00f682bfc7b111d7f584092.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2648	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2636	ipconfig.exe
2552	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	tasklist.exe
Token: SeDebugPrivilege	2552	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3056	1635a477c00f682bfc7b111d7f584092.exe
3056	1635a477c00f682bfc7b111d7f584092.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1916	3056	1635a477c00f682bfc7b111d7f584092.exe	29
PID 3056 wrote to memory of 1916	3056	1635a477c00f682bfc7b111d7f584092.exe	29
PID 3056 wrote to memory of 1916	3056	1635a477c00f682bfc7b111d7f584092.exe	29
PID 3056 wrote to memory of 1916	3056	1635a477c00f682bfc7b111d7f584092.exe	29
PID 1916 wrote to memory of 3028	1916	cmd.exe	31
PID 1916 wrote to memory of 3028	1916	cmd.exe	31
PID 1916 wrote to memory of 3028	1916	cmd.exe	31
PID 1916 wrote to memory of 3028	1916	cmd.exe	31
PID 1916 wrote to memory of 2636	1916	cmd.exe	32
PID 1916 wrote to memory of 2636	1916	cmd.exe	32
PID 1916 wrote to memory of 2636	1916	cmd.exe	32
PID 1916 wrote to memory of 2636	1916	cmd.exe	32
PID 1916 wrote to memory of 2648	1916	cmd.exe	33
PID 1916 wrote to memory of 2648	1916	cmd.exe	33
PID 1916 wrote to memory of 2648	1916	cmd.exe	33
PID 1916 wrote to memory of 2648	1916	cmd.exe	33
PID 1916 wrote to memory of 2956	1916	cmd.exe	34
PID 1916 wrote to memory of 2956	1916	cmd.exe	34
PID 1916 wrote to memory of 2956	1916	cmd.exe	34
PID 1916 wrote to memory of 2956	1916	cmd.exe	34
PID 2956 wrote to memory of 2696	2956	net.exe	35
PID 2956 wrote to memory of 2696	2956	net.exe	35
PID 2956 wrote to memory of 2696	2956	net.exe	35
PID 2956 wrote to memory of 2696	2956	net.exe	35
PID 1916 wrote to memory of 2552	1916	cmd.exe	36
PID 1916 wrote to memory of 2552	1916	cmd.exe	36
PID 1916 wrote to memory of 2552	1916	cmd.exe	36
PID 1916 wrote to memory of 2552	1916	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\1635a477c00f682bfc7b111d7f584092.exe
"C:\Users\Admin\AppData\Local\Temp\1635a477c00f682bfc7b111d7f584092.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2636
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2696
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
842669dc38baf4d04f6ce6bb30fa4383

SHA1
eba699d265e7a1c0b40b0900e852ba715be64fd5

SHA256
36c77e8792ee124777fd94c624da86d3c27a67f009c7c99542db67c7c19a545f

SHA512
ce1062d9316b78e4222e48e4439a0ab86cc5b2cb5f90dc4adce16780789f1f8bb225049f0ef0e6d9ea39469092dfa8b7ecbd88f2194ce3db261e5092aa385484

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads