59dcff81d944e88b11465376090be9f785663d4649e0ddab87549f05c7710be5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22648fad1c3aece936e1797c041c39a9.exe
Size

24KB
MD5

22648fad1c3aece936e1797c041c39a9
SHA1

9dbf0d596c717b2404b5a4dfb00d779d4cc4a80c
SHA256

59dcff81d944e88b11465376090be9f785663d4649e0ddab87549f05c7710be5
SHA512

217796326c7dbc76a6de879e4242dcbed443150b13f140a3c8977b767e00c363c35e143f85184f2e9686a30d0131138f5b832bf265326490713e1999ded08cff
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5d0:bGS+ZfbJiO8qYoAS

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	22648fad1c3aece936e1797c041c39a9.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	22648fad1c3aece936e1797c041c39a9.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3044	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2968	ipconfig.exe
2676	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	tasklist.exe
Token: SeDebugPrivilege	2676	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	22648fad1c3aece936e1797c041c39a9.exe
2368	22648fad1c3aece936e1797c041c39a9.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2188	2368	22648fad1c3aece936e1797c041c39a9.exe	16
PID 2368 wrote to memory of 2188	2368	22648fad1c3aece936e1797c041c39a9.exe	16
PID 2368 wrote to memory of 2188	2368	22648fad1c3aece936e1797c041c39a9.exe	16
PID 2368 wrote to memory of 2188	2368	22648fad1c3aece936e1797c041c39a9.exe	16
PID 2188 wrote to memory of 2760	2188	cmd.exe	23
PID 2188 wrote to memory of 2760	2188	cmd.exe	23
PID 2188 wrote to memory of 2760	2188	cmd.exe	23
PID 2188 wrote to memory of 2760	2188	cmd.exe	23
PID 2188 wrote to memory of 2968	2188	cmd.exe	17
PID 2188 wrote to memory of 2968	2188	cmd.exe	17
PID 2188 wrote to memory of 2968	2188	cmd.exe	17
PID 2188 wrote to memory of 2968	2188	cmd.exe	17
PID 2188 wrote to memory of 3044	2188	cmd.exe	18
PID 2188 wrote to memory of 3044	2188	cmd.exe	18
PID 2188 wrote to memory of 3044	2188	cmd.exe	18
PID 2188 wrote to memory of 3044	2188	cmd.exe	18
PID 2188 wrote to memory of 2632	2188	cmd.exe	22
PID 2188 wrote to memory of 2632	2188	cmd.exe	22
PID 2188 wrote to memory of 2632	2188	cmd.exe	22
PID 2188 wrote to memory of 2632	2188	cmd.exe	22
PID 2632 wrote to memory of 2648	2632	net.exe	21
PID 2632 wrote to memory of 2648	2632	net.exe	21
PID 2632 wrote to memory of 2648	2632	net.exe	21
PID 2632 wrote to memory of 2648	2632	net.exe	21
PID 2188 wrote to memory of 2676	2188	cmd.exe	20
PID 2188 wrote to memory of 2676	2188	cmd.exe	20
PID 2188 wrote to memory of 2676	2188	cmd.exe	20
PID 2188 wrote to memory of 2676	2188	cmd.exe	20

C:\Windows\SysWOW64\cmd.exe
cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:2968
- C:\Windows\SysWOW64\tasklist.exe
  tasklist
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\SysWOW64\NETSTAT.EXE
  netstat -an
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\SysWOW64\net.exe
  net start
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c set
  2⤵
  PID:2760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start
1⤵
PID:2648

C:\Users\Admin\AppData\Local\Temp\22648fad1c3aece936e1797c041c39a9.exe
"C:\Users\Admin\AppData\Local\Temp\22648fad1c3aece936e1797c041c39a9.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
04a90bf5295930b1feb2e063b4532f41

SHA1
966300eb547ca21d67509fa14a18dd78efa10fa3

SHA256
c6696f56f8c4a74608eb269163a0f040c30729e53ce4ad8082c246673b69277a

SHA512
7ba630bde2079e43baac76dac6e80052a56db9a165cda2decfdf4c8bf594a786b2223cc679d2147a909ccc4b85b44b82b0ef3d5ec285bfe861e2ebfce05cc600

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads