a37656b0453c615e8dc213eec284a51f3a9a22479626546b001598961b3c0a5c

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 20:41

Target

3f070f9a8ef845966e717fb50020361b.exe
Size

24KB
MD5

3f070f9a8ef845966e717fb50020361b
SHA1

edbdcabeda9a859a5cf15b4bce645c5aa64b0b66
SHA256

a37656b0453c615e8dc213eec284a51f3a9a22479626546b001598961b3c0a5c
SHA512

88b463b7863f24261a83fab2fe457a5df47cbd9579cceaaee2b5094e77699ab8d6694f208afa5f626b64ed00ca2f3c69208299e3187d3bc48eef997aa3f602f8
SSDEEP

384:E3eVES+/xwGkRKJRgNlM61qmTTMVF9/q550:bGS+ZfbJRgNO8qYoAG

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	3f070f9a8ef845966e717fb50020361b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	3f070f9a8ef845966e717fb50020361b.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2708	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
2344	ipconfig.exe
2924	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	tasklist.exe
Token: SeDebugPrivilege	2924	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
356	3f070f9a8ef845966e717fb50020361b.exe
356	3f070f9a8ef845966e717fb50020361b.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 356 wrote to memory of 1960	356	3f070f9a8ef845966e717fb50020361b.exe	16
PID 356 wrote to memory of 1960	356	3f070f9a8ef845966e717fb50020361b.exe	16
PID 356 wrote to memory of 1960	356	3f070f9a8ef845966e717fb50020361b.exe	16
PID 356 wrote to memory of 1960	356	3f070f9a8ef845966e717fb50020361b.exe	16
PID 1960 wrote to memory of 2640	1960	cmd.exe	23
PID 1960 wrote to memory of 2640	1960	cmd.exe	23
PID 1960 wrote to memory of 2640	1960	cmd.exe	23
PID 1960 wrote to memory of 2640	1960	cmd.exe	23
PID 1960 wrote to memory of 2344	1960	cmd.exe	17
PID 1960 wrote to memory of 2344	1960	cmd.exe	17
PID 1960 wrote to memory of 2344	1960	cmd.exe	17
PID 1960 wrote to memory of 2344	1960	cmd.exe	17
PID 1960 wrote to memory of 2708	1960	cmd.exe	18
PID 1960 wrote to memory of 2708	1960	cmd.exe	18
PID 1960 wrote to memory of 2708	1960	cmd.exe	18
PID 1960 wrote to memory of 2708	1960	cmd.exe	18
PID 1960 wrote to memory of 2684	1960	cmd.exe	22
PID 1960 wrote to memory of 2684	1960	cmd.exe	22
PID 1960 wrote to memory of 2684	1960	cmd.exe	22
PID 1960 wrote to memory of 2684	1960	cmd.exe	22
PID 2684 wrote to memory of 2556	2684	net.exe	21
PID 2684 wrote to memory of 2556	2684	net.exe	21
PID 2684 wrote to memory of 2556	2684	net.exe	21
PID 2684 wrote to memory of 2556	2684	net.exe	21
PID 1960 wrote to memory of 2924	1960	cmd.exe	20
PID 1960 wrote to memory of 2924	1960	cmd.exe	20
PID 1960 wrote to memory of 2924	1960	cmd.exe	20
PID 1960 wrote to memory of 2924	1960	cmd.exe	20