27de4dd7a51e9acfaee18f8243102520af93c0c6d2e18d354593e63c5a3c5861

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:18

Target

16f74bdbe92d287081aa4acad3340976.exe
Size

24KB
MD5

16f74bdbe92d287081aa4acad3340976
SHA1

0a6018fbe093fc1808302b190d09253ab89d401c
SHA256

27de4dd7a51e9acfaee18f8243102520af93c0c6d2e18d354593e63c5a3c5861
SHA512

b930df8b6f8ae671f85ca0c0b5a344ed96a001349b504117f650e63be4d977e06f3453ce1d18a40dd99511cb012353e3eb0c9cdc845747ddcd96cb837081e596
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5f0:bGS+ZfbJiO8qYoAc

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	16f74bdbe92d287081aa4acad3340976.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	16f74bdbe92d287081aa4acad3340976.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2676	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
2368	ipconfig.exe
2684	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	tasklist.exe
Token: SeDebugPrivilege	2684	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	16f74bdbe92d287081aa4acad3340976.exe
3004	16f74bdbe92d287081aa4acad3340976.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2276	3004	16f74bdbe92d287081aa4acad3340976.exe	16
PID 3004 wrote to memory of 2276	3004	16f74bdbe92d287081aa4acad3340976.exe	16
PID 3004 wrote to memory of 2276	3004	16f74bdbe92d287081aa4acad3340976.exe	16
PID 3004 wrote to memory of 2276	3004	16f74bdbe92d287081aa4acad3340976.exe	16
PID 2276 wrote to memory of 2968	2276	cmd.exe	23
PID 2276 wrote to memory of 2968	2276	cmd.exe	23
PID 2276 wrote to memory of 2968	2276	cmd.exe	23
PID 2276 wrote to memory of 2968	2276	cmd.exe	23
PID 2276 wrote to memory of 2368	2276	cmd.exe	17
PID 2276 wrote to memory of 2368	2276	cmd.exe	17
PID 2276 wrote to memory of 2368	2276	cmd.exe	17
PID 2276 wrote to memory of 2368	2276	cmd.exe	17
PID 2276 wrote to memory of 2676	2276	cmd.exe	18
PID 2276 wrote to memory of 2676	2276	cmd.exe	18
PID 2276 wrote to memory of 2676	2276	cmd.exe	18
PID 2276 wrote to memory of 2676	2276	cmd.exe	18
PID 2276 wrote to memory of 2692	2276	cmd.exe	22
PID 2276 wrote to memory of 2692	2276	cmd.exe	22
PID 2276 wrote to memory of 2692	2276	cmd.exe	22
PID 2276 wrote to memory of 2692	2276	cmd.exe	22
PID 2692 wrote to memory of 2576	2692	net.exe	20
PID 2692 wrote to memory of 2576	2692	net.exe	20
PID 2692 wrote to memory of 2576	2692	net.exe	20
PID 2692 wrote to memory of 2576	2692	net.exe	20
PID 2276 wrote to memory of 2684	2276	cmd.exe	21
PID 2276 wrote to memory of 2684	2276	cmd.exe	21
PID 2276 wrote to memory of 2684	2276	cmd.exe	21
PID 2276 wrote to memory of 2684	2276	cmd.exe	21

C:\Windows\SysWOW64\cmd.exe
cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
1⤵
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:2368
- C:\Windows\SysWOW64\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\SysWOW64\NETSTAT.EXE
  netstat -an
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Windows\SysWOW64\net.exe
  net start
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set
  2⤵
  PID:2968