cfe8a218c3bcb9e7ced3ea1a7a3f8cf96719f22fb24cf419d9af1ea6a616cb4d

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1635a477c00f682bfc7b111d7f584092.exe
Size

24KB
MD5

1635a477c00f682bfc7b111d7f584092
SHA1

141a1a8fa7d430750363a00e0960c47c2f39c053
SHA256

cfe8a218c3bcb9e7ced3ea1a7a3f8cf96719f22fb24cf419d9af1ea6a616cb4d
SHA512

d182da75065d1f1df0a6d0f2e9b89230c950f32b0b5457e197cae744bae334b432cec74ee7f39c89ebaf52c06220ddb2ee987a3292ed246d1a2e96c6c7414f74
SSDEEP

384:E3eVES+/xwGkRKJ7W+qMAqQWlM61qmTTMVF9/q5E0:bGS+ZfbJ2qQWO8qYoAl

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	1635a477c00f682bfc7b111d7f584092.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	1635a477c00f682bfc7b111d7f584092.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4544	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2060	NETSTAT.EXE
1556	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	tasklist.exe
Token: SeDebugPrivilege	2060	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4412	1635a477c00f682bfc7b111d7f584092.exe
4412	1635a477c00f682bfc7b111d7f584092.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3596	4412	1635a477c00f682bfc7b111d7f584092.exe	29
PID 4412 wrote to memory of 3596	4412	1635a477c00f682bfc7b111d7f584092.exe	29
PID 4412 wrote to memory of 3596	4412	1635a477c00f682bfc7b111d7f584092.exe	29
PID 3596 wrote to memory of 4108	3596	cmd.exe	28
PID 3596 wrote to memory of 4108	3596	cmd.exe	28
PID 3596 wrote to memory of 4108	3596	cmd.exe	28
PID 3596 wrote to memory of 1556	3596	cmd.exe	27
PID 3596 wrote to memory of 1556	3596	cmd.exe	27
PID 3596 wrote to memory of 1556	3596	cmd.exe	27
PID 3596 wrote to memory of 4544	3596	cmd.exe	19
PID 3596 wrote to memory of 4544	3596	cmd.exe	19
PID 3596 wrote to memory of 4544	3596	cmd.exe	19
PID 3596 wrote to memory of 3264	3596	cmd.exe	23
PID 3596 wrote to memory of 3264	3596	cmd.exe	23
PID 3596 wrote to memory of 3264	3596	cmd.exe	23
PID 3264 wrote to memory of 2416	3264	net.exe	26
PID 3264 wrote to memory of 2416	3264	net.exe	26
PID 3264 wrote to memory of 2416	3264	net.exe	26
PID 3596 wrote to memory of 2060	3596	cmd.exe	24
PID 3596 wrote to memory of 2060	3596	cmd.exe	24
PID 3596 wrote to memory of 2060	3596	cmd.exe	24

C:\Users\Admin\AppData\Local\Temp\1635a477c00f682bfc7b111d7f584092.exe
"C:\Users\Admin\AppData\Local\Temp\1635a477c00f682bfc7b111d7f584092.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3596

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\SysWOW64\net.exe
net start
1⤵
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\net1.exe
  C:\Windows\system32\net1 start
  2⤵
  PID:2416

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -an
1⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
1⤵
- Gathers network information
PID:1556

C:\Windows\SysWOW64\cmd.exe
cmd /c set
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
15KB

MD5
0a19c9b351925bf92b9386ba16b14c97

SHA1
d9a25311e8ccef35c659ae13113902e38bfcf209

SHA256
8f38d75279688eaf8823fdc37068cc8a0e953aa5718b726b6a011dbe876ff009

SHA512
66c801b24bfb05984b2c40602fc941d8b05d68b6f53c991cc955b7b56bf5b82c01187171cb59b40f29dab529ad73dfb1d5d8739aef7707d2b4152fa09d7d8510

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads