949c9c1dbc934c93a83c59fb378d080a92dd0afeef8d1024c6ac607fa447cd49

Analysis

max time kernel
117s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2472350d154e6838668971e5bc5f75cf.exe
Size

24KB
MD5

2472350d154e6838668971e5bc5f75cf
SHA1

4c3e627eb19b1216f3ac68560b2eff5e8ab86a51
SHA256

949c9c1dbc934c93a83c59fb378d080a92dd0afeef8d1024c6ac607fa447cd49
SHA512

e8698d3ba81035d7ea514b6daf2a574b45a9fecda3dc97b1f1e3af78aef709f539fccf8d0140cdaecd51d828e89e2194d994a4bd81c4216b9cad61f2c7ceb67c
SSDEEP

384:E3eVES+/xwGkRKJr9lM61qmTTMVF9/q5Y0:bGS+ZfbJZO8qYoAh

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2472350d154e6838668971e5bc5f75cf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2472350d154e6838668971e5bc5f75cf.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2308	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2828	ipconfig.exe
2692	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	2692	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3008	2472350d154e6838668971e5bc5f75cf.exe
3008	2472350d154e6838668971e5bc5f75cf.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2320	3008	2472350d154e6838668971e5bc5f75cf.exe	28
PID 3008 wrote to memory of 2320	3008	2472350d154e6838668971e5bc5f75cf.exe	28
PID 3008 wrote to memory of 2320	3008	2472350d154e6838668971e5bc5f75cf.exe	28
PID 3008 wrote to memory of 2320	3008	2472350d154e6838668971e5bc5f75cf.exe	28
PID 2320 wrote to memory of 2688	2320	cmd.exe	30
PID 2320 wrote to memory of 2688	2320	cmd.exe	30
PID 2320 wrote to memory of 2688	2320	cmd.exe	30
PID 2320 wrote to memory of 2688	2320	cmd.exe	30
PID 2320 wrote to memory of 2828	2320	cmd.exe	31
PID 2320 wrote to memory of 2828	2320	cmd.exe	31
PID 2320 wrote to memory of 2828	2320	cmd.exe	31
PID 2320 wrote to memory of 2828	2320	cmd.exe	31
PID 2320 wrote to memory of 2308	2320	cmd.exe	32
PID 2320 wrote to memory of 2308	2320	cmd.exe	32
PID 2320 wrote to memory of 2308	2320	cmd.exe	32
PID 2320 wrote to memory of 2308	2320	cmd.exe	32
PID 2320 wrote to memory of 804	2320	cmd.exe	34
PID 2320 wrote to memory of 804	2320	cmd.exe	34
PID 2320 wrote to memory of 804	2320	cmd.exe	34
PID 2320 wrote to memory of 804	2320	cmd.exe	34
PID 804 wrote to memory of 2884	804	net.exe	35
PID 804 wrote to memory of 2884	804	net.exe	35
PID 804 wrote to memory of 2884	804	net.exe	35
PID 804 wrote to memory of 2884	804	net.exe	35
PID 2320 wrote to memory of 2692	2320	cmd.exe	36
PID 2320 wrote to memory of 2692	2320	cmd.exe	36
PID 2320 wrote to memory of 2692	2320	cmd.exe	36
PID 2320 wrote to memory of 2692	2320	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\2472350d154e6838668971e5bc5f75cf.exe
"C:\Users\Admin\AppData\Local\Temp\2472350d154e6838668971e5bc5f75cf.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2688
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2828
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2884
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
5e9469c3b2a4a5b3a276881c727f7f73

SHA1
0184f428a6126aec60b8ced0dad4a4018a42a2ec

SHA256
9d9d09d3426a867868aef1f0539b4187f25bcd0692382f5b39fd65bb8205676d

SHA512
f41285897511a7548320197eebccdf1c9a7f815be62b00d4e84e853e9921bf8cd654a89956a27833c26e7f333dd21a76ebd72930094a592319be0284ca943956

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads