476e7691bc1e12914b6fef413af13ec4753ad9d4ae1b60032a821b0fd45a1270

Analysis

max time kernel
146s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 12:58

Target

193f6eb1ce1c00c1560c8aa92a74c0f3.exe
Size

24KB
MD5

193f6eb1ce1c00c1560c8aa92a74c0f3
SHA1

b9b87f11911c1168677bcc349fbc8e9075727c15
SHA256

476e7691bc1e12914b6fef413af13ec4753ad9d4ae1b60032a821b0fd45a1270
SHA512

0d4a16cff5fe6b477a41d866ad57daf289a43ba9d659e6e85c5ea4603e75d77e9ab2258d7dc14f7b5b22fb8936bf30d8b50e8a6c44938324398666e360d8019c
SSDEEP

384:E3eVES+/xwGkRKJLFlM61qmTTMVF9/q5X0:bGS+ZfbJxO8qYoAE

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	193f6eb1ce1c00c1560c8aa92a74c0f3.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	193f6eb1ce1c00c1560c8aa92a74c0f3.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
4252	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
4984	ipconfig.exe
2100	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	tasklist.exe
Token: SeDebugPrivilege	2100	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1676	193f6eb1ce1c00c1560c8aa92a74c0f3.exe
1676	193f6eb1ce1c00c1560c8aa92a74c0f3.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 768	1676	193f6eb1ce1c00c1560c8aa92a74c0f3.exe	95
PID 1676 wrote to memory of 768	1676	193f6eb1ce1c00c1560c8aa92a74c0f3.exe	95
PID 1676 wrote to memory of 768	1676	193f6eb1ce1c00c1560c8aa92a74c0f3.exe	95
PID 768 wrote to memory of 4872	768	cmd.exe	97
PID 768 wrote to memory of 4872	768	cmd.exe	97
PID 768 wrote to memory of 4872	768	cmd.exe	97
PID 768 wrote to memory of 4984	768	cmd.exe	99
PID 768 wrote to memory of 4984	768	cmd.exe	99
PID 768 wrote to memory of 4984	768	cmd.exe	99
PID 768 wrote to memory of 4252	768	cmd.exe	100
PID 768 wrote to memory of 4252	768	cmd.exe	100
PID 768 wrote to memory of 4252	768	cmd.exe	100
PID 768 wrote to memory of 3312	768	cmd.exe	101
PID 768 wrote to memory of 3312	768	cmd.exe	101
PID 768 wrote to memory of 3312	768	cmd.exe	101
PID 3312 wrote to memory of 1980	3312	net.exe	102
PID 3312 wrote to memory of 1980	3312	net.exe	102
PID 3312 wrote to memory of 1980	3312	net.exe	102
PID 768 wrote to memory of 2100	768	cmd.exe	103
PID 768 wrote to memory of 2100	768	cmd.exe	103
PID 768 wrote to memory of 2100	768	cmd.exe	103