949c9c1dbc934c93a83c59fb378d080a92dd0afeef8d1024c6ac607fa447cd49

Analysis

max time kernel
151s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:26

Target

2472350d154e6838668971e5bc5f75cf.exe
Size

24KB
MD5

2472350d154e6838668971e5bc5f75cf
SHA1

4c3e627eb19b1216f3ac68560b2eff5e8ab86a51
SHA256

949c9c1dbc934c93a83c59fb378d080a92dd0afeef8d1024c6ac607fa447cd49
SHA512

e8698d3ba81035d7ea514b6daf2a574b45a9fecda3dc97b1f1e3af78aef709f539fccf8d0140cdaecd51d828e89e2194d994a4bd81c4216b9cad61f2c7ceb67c
SSDEEP

384:E3eVES+/xwGkRKJr9lM61qmTTMVF9/q5Y0:bGS+ZfbJZO8qYoAh

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	2472350d154e6838668971e5bc5f75cf.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	2472350d154e6838668971e5bc5f75cf.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
4140	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
832	ipconfig.exe
3732	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	tasklist.exe
Token: SeDebugPrivilege	3732	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3000	2472350d154e6838668971e5bc5f75cf.exe
3000	2472350d154e6838668971e5bc5f75cf.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3480	3000	2472350d154e6838668971e5bc5f75cf.exe	92
PID 3000 wrote to memory of 3480	3000	2472350d154e6838668971e5bc5f75cf.exe	92
PID 3000 wrote to memory of 3480	3000	2472350d154e6838668971e5bc5f75cf.exe	92
PID 3480 wrote to memory of 2488	3480	cmd.exe	94
PID 3480 wrote to memory of 2488	3480	cmd.exe	94
PID 3480 wrote to memory of 2488	3480	cmd.exe	94
PID 3480 wrote to memory of 832	3480	cmd.exe	95
PID 3480 wrote to memory of 832	3480	cmd.exe	95
PID 3480 wrote to memory of 832	3480	cmd.exe	95
PID 3480 wrote to memory of 4140	3480	cmd.exe	96
PID 3480 wrote to memory of 4140	3480	cmd.exe	96
PID 3480 wrote to memory of 4140	3480	cmd.exe	96
PID 3480 wrote to memory of 1120	3480	cmd.exe	100
PID 3480 wrote to memory of 1120	3480	cmd.exe	100
PID 3480 wrote to memory of 1120	3480	cmd.exe	100
PID 1120 wrote to memory of 1020	1120	net.exe	101
PID 1120 wrote to memory of 1020	1120	net.exe	101
PID 1120 wrote to memory of 1020	1120	net.exe	101
PID 3480 wrote to memory of 3732	3480	cmd.exe	102
PID 3480 wrote to memory of 3732	3480	cmd.exe	102
PID 3480 wrote to memory of 3732	3480	cmd.exe	102