cbab91207f8627ffa3726dc7dbf77564737e9d3417e09abd8af4a97366d94d84

Analysis

max time kernel
0s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 14:12

Target

1b13dc6bb8caff8c02beca6e530a09be.exe
Size

24KB
MD5

1b13dc6bb8caff8c02beca6e530a09be
SHA1

ebc63ae621bc1382bea06af588903807b1ebf7f6
SHA256

cbab91207f8627ffa3726dc7dbf77564737e9d3417e09abd8af4a97366d94d84
SHA512

450b5e3f85073ef1cecad2f23c702e8e9a3a05de4aa9f5977883a79e03bab7429db1cf06b2849e89f3850d5baa1d6d45491dcb0b192d718089d7a61bbd0970ac
SSDEEP

384:E3eVES+/xwGkRKJU6nMxlM61qmTTMVF9/q5g0:bGS+ZfbJHnyO8qYoAZ

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	1b13dc6bb8caff8c02beca6e530a09be.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	1b13dc6bb8caff8c02beca6e530a09be.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
4308	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
3216	ipconfig.exe
4444	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4524	1b13dc6bb8caff8c02beca6e530a09be.exe
4524	1b13dc6bb8caff8c02beca6e530a09be.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1416	4524	1b13dc6bb8caff8c02beca6e530a09be.exe	16
PID 4524 wrote to memory of 1416	4524	1b13dc6bb8caff8c02beca6e530a09be.exe	16
PID 4524 wrote to memory of 1416	4524	1b13dc6bb8caff8c02beca6e530a09be.exe	16
PID 1416 wrote to memory of 2544	1416	cmd.exe	25
PID 1416 wrote to memory of 2544	1416	cmd.exe	25
PID 1416 wrote to memory of 2544	1416	cmd.exe	25
PID 1416 wrote to memory of 3216	1416	cmd.exe	18
PID 1416 wrote to memory of 3216	1416	cmd.exe	18
PID 1416 wrote to memory of 3216	1416	cmd.exe	18
PID 1416 wrote to memory of 4308	1416	cmd.exe	19
PID 1416 wrote to memory of 4308	1416	cmd.exe	19
PID 1416 wrote to memory of 4308	1416	cmd.exe	19