77db34a81ba10796571337ae161331b209ddce3d19257ed7b82d9779ce39f782

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c6344588e459db6d579b8ce20bd2be2.exe
Size

24KB
MD5

1c6344588e459db6d579b8ce20bd2be2
SHA1

db7657dac99ba53ce6cb029632ec9eb4544a10de
SHA256

77db34a81ba10796571337ae161331b209ddce3d19257ed7b82d9779ce39f782
SHA512

4fc33b421f7458b247c47ee1d73bd7f9570c25580b0f95954e038e1a6dd886f9f179273c6b976296f7d7573950a039e8d2e423bfc9bf4df3929f4cc7e90e67b8
SSDEEP

384:E3eVES+/xwGkRKJLtwmVlM61qmTTMVF9/q5H0:bGS+ZfbJLhVO8qYoAU

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	1c6344588e459db6d579b8ce20bd2be2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	1c6344588e459db6d579b8ce20bd2be2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1352	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2768	ipconfig.exe
2576	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	tasklist.exe
Token: SeDebugPrivilege	2576	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2332	1c6344588e459db6d579b8ce20bd2be2.exe
2332	1c6344588e459db6d579b8ce20bd2be2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2424	2332	1c6344588e459db6d579b8ce20bd2be2.exe	28
PID 2332 wrote to memory of 2424	2332	1c6344588e459db6d579b8ce20bd2be2.exe	28
PID 2332 wrote to memory of 2424	2332	1c6344588e459db6d579b8ce20bd2be2.exe	28
PID 2332 wrote to memory of 2424	2332	1c6344588e459db6d579b8ce20bd2be2.exe	28
PID 2424 wrote to memory of 2248	2424	cmd.exe	30
PID 2424 wrote to memory of 2248	2424	cmd.exe	30
PID 2424 wrote to memory of 2248	2424	cmd.exe	30
PID 2424 wrote to memory of 2248	2424	cmd.exe	30
PID 2424 wrote to memory of 2768	2424	cmd.exe	31
PID 2424 wrote to memory of 2768	2424	cmd.exe	31
PID 2424 wrote to memory of 2768	2424	cmd.exe	31
PID 2424 wrote to memory of 2768	2424	cmd.exe	31
PID 2424 wrote to memory of 1352	2424	cmd.exe	32
PID 2424 wrote to memory of 1352	2424	cmd.exe	32
PID 2424 wrote to memory of 1352	2424	cmd.exe	32
PID 2424 wrote to memory of 1352	2424	cmd.exe	32
PID 2424 wrote to memory of 3060	2424	cmd.exe	34
PID 2424 wrote to memory of 3060	2424	cmd.exe	34
PID 2424 wrote to memory of 3060	2424	cmd.exe	34
PID 2424 wrote to memory of 3060	2424	cmd.exe	34
PID 3060 wrote to memory of 2928	3060	net.exe	35
PID 3060 wrote to memory of 2928	3060	net.exe	35
PID 3060 wrote to memory of 2928	3060	net.exe	35
PID 3060 wrote to memory of 2928	3060	net.exe	35
PID 2424 wrote to memory of 2576	2424	cmd.exe	36
PID 2424 wrote to memory of 2576	2424	cmd.exe	36
PID 2424 wrote to memory of 2576	2424	cmd.exe	36
PID 2424 wrote to memory of 2576	2424	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\1c6344588e459db6d579b8ce20bd2be2.exe
"C:\Users\Admin\AppData\Local\Temp\1c6344588e459db6d579b8ce20bd2be2.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2768
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1352
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2928
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
110ee6649ae59f4de63ec00ea139a1f9

SHA1
9d8815c85481bd040774b651943dd638e1105201

SHA256
635dfa774cdf24cf34093192653d66560075c0c7c3efbed803c9804d58299a8e

SHA512
2986bd08a865d9d969fd88fca1c07409a226f98830611864c5352f76d0ce28ca8f39f281b97d63a56136414ebd881cfff430b6136ed495213fd9df8381fbc880

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads