282b7f3641809afe9e4223327b84b16491a7aa88076093d1f51100342073ecba

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 07:36

Target

3c4431e12aad65e83b0b858e1ff9e0ed.exe
Size

24KB
MD5

3c4431e12aad65e83b0b858e1ff9e0ed
SHA1

42419bda2f5fcd9344870ac7bcca6ad67ef4dd5d
SHA256

282b7f3641809afe9e4223327b84b16491a7aa88076093d1f51100342073ecba
SHA512

5ec05ac8a96c238dfce21b807661ff843aa99d8c185b70459ed9637cf4648941e8e9ee840b3ce0f0b23426fa30e1344c6fac4e974fa1277263644fb204c8e022
SSDEEP

384:E3eVES+/xwGkRKJKlM61qmTTMVF9/q5r0:bGS+ZfbJKO8qYoAg

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	3c4431e12aad65e83b0b858e1ff9e0ed.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	3c4431e12aad65e83b0b858e1ff9e0ed.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2280	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
1392	ipconfig.exe
2700	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	tasklist.exe
Token: SeDebugPrivilege	2700	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1924	3c4431e12aad65e83b0b858e1ff9e0ed.exe
1924	3c4431e12aad65e83b0b858e1ff9e0ed.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2392	1924	3c4431e12aad65e83b0b858e1ff9e0ed.exe	16
PID 1924 wrote to memory of 2392	1924	3c4431e12aad65e83b0b858e1ff9e0ed.exe	16
PID 1924 wrote to memory of 2392	1924	3c4431e12aad65e83b0b858e1ff9e0ed.exe	16
PID 1924 wrote to memory of 2392	1924	3c4431e12aad65e83b0b858e1ff9e0ed.exe	16
PID 2392 wrote to memory of 1824	2392	cmd.exe	23
PID 2392 wrote to memory of 1824	2392	cmd.exe	23
PID 2392 wrote to memory of 1824	2392	cmd.exe	23
PID 2392 wrote to memory of 1824	2392	cmd.exe	23
PID 2392 wrote to memory of 1392	2392	cmd.exe	17
PID 2392 wrote to memory of 1392	2392	cmd.exe	17
PID 2392 wrote to memory of 1392	2392	cmd.exe	17
PID 2392 wrote to memory of 1392	2392	cmd.exe	17
PID 2392 wrote to memory of 2280	2392	cmd.exe	18
PID 2392 wrote to memory of 2280	2392	cmd.exe	18
PID 2392 wrote to memory of 2280	2392	cmd.exe	18
PID 2392 wrote to memory of 2280	2392	cmd.exe	18
PID 2392 wrote to memory of 2680	2392	cmd.exe	20
PID 2392 wrote to memory of 2680	2392	cmd.exe	20
PID 2392 wrote to memory of 2680	2392	cmd.exe	20
PID 2392 wrote to memory of 2680	2392	cmd.exe	20
PID 2680 wrote to memory of 2684	2680	net.exe	22
PID 2680 wrote to memory of 2684	2680	net.exe	22
PID 2680 wrote to memory of 2684	2680	net.exe	22
PID 2680 wrote to memory of 2684	2680	net.exe	22
PID 2392 wrote to memory of 2700	2392	cmd.exe	21
PID 2392 wrote to memory of 2700	2392	cmd.exe	21
PID 2392 wrote to memory of 2700	2392	cmd.exe	21
PID 2392 wrote to memory of 2700	2392	cmd.exe	21