98e598bb032d1a79674c2750145420c25478ce7f6d38732921e8208979212c0b

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/01/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40e30893fffd8d3add2c9bf05b090787.exe
Size

24KB
MD5

40e30893fffd8d3add2c9bf05b090787
SHA1

372e63c8bdc4da260d0181a76a338a819a90e735
SHA256

98e598bb032d1a79674c2750145420c25478ce7f6d38732921e8208979212c0b
SHA512

5075a748d98e83f96c852d16006fa3db516d64cb61b6dff3aa9e6738e6085fcd657e4bd448a7192a4e8bbe5ce53484a62ff463dfd11ae8753dfb77ab2fe8cf16
SSDEEP

384:E3eVES+/xwGkRKJolM61qmTTMVF9/q5h0:bGS+ZfbJoO8qYoA+

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	40e30893fffd8d3add2c9bf05b090787.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	40e30893fffd8d3add2c9bf05b090787.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2488	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2336	ipconfig.exe
2608	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	tasklist.exe
Token: SeDebugPrivilege	2608	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1068	40e30893fffd8d3add2c9bf05b090787.exe
1068	40e30893fffd8d3add2c9bf05b090787.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2272	1068	40e30893fffd8d3add2c9bf05b090787.exe	28
PID 1068 wrote to memory of 2272	1068	40e30893fffd8d3add2c9bf05b090787.exe	28
PID 1068 wrote to memory of 2272	1068	40e30893fffd8d3add2c9bf05b090787.exe	28
PID 1068 wrote to memory of 2272	1068	40e30893fffd8d3add2c9bf05b090787.exe	28
PID 2272 wrote to memory of 2748	2272	cmd.exe	30
PID 2272 wrote to memory of 2748	2272	cmd.exe	30
PID 2272 wrote to memory of 2748	2272	cmd.exe	30
PID 2272 wrote to memory of 2748	2272	cmd.exe	30
PID 2272 wrote to memory of 2336	2272	cmd.exe	31
PID 2272 wrote to memory of 2336	2272	cmd.exe	31
PID 2272 wrote to memory of 2336	2272	cmd.exe	31
PID 2272 wrote to memory of 2336	2272	cmd.exe	31
PID 2272 wrote to memory of 2488	2272	cmd.exe	32
PID 2272 wrote to memory of 2488	2272	cmd.exe	32
PID 2272 wrote to memory of 2488	2272	cmd.exe	32
PID 2272 wrote to memory of 2488	2272	cmd.exe	32
PID 2272 wrote to memory of 2548	2272	cmd.exe	34
PID 2272 wrote to memory of 2548	2272	cmd.exe	34
PID 2272 wrote to memory of 2548	2272	cmd.exe	34
PID 2272 wrote to memory of 2548	2272	cmd.exe	34
PID 2548 wrote to memory of 2552	2548	net.exe	35
PID 2548 wrote to memory of 2552	2548	net.exe	35
PID 2548 wrote to memory of 2552	2548	net.exe	35
PID 2548 wrote to memory of 2552	2548	net.exe	35
PID 2272 wrote to memory of 2608	2272	cmd.exe	36
PID 2272 wrote to memory of 2608	2272	cmd.exe	36
PID 2272 wrote to memory of 2608	2272	cmd.exe	36
PID 2272 wrote to memory of 2608	2272	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\40e30893fffd8d3add2c9bf05b090787.exe
"C:\Users\Admin\AppData\Local\Temp\40e30893fffd8d3add2c9bf05b090787.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2336
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2552
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
e986b50e20a86233818c58d9cc289c83

SHA1
f396132d2e9d585a48e057b56362ff6975b5996c

SHA256
d24de0e25a157b3d00dc300e5609aa4e76666d5fdf191a4169783a1013a73e0c

SHA512
25baa6dcd2b14d400cc9dfcaaa7f8335f7976bbec7f7615ce5d2fd86f9da77c3d764840dc43bcf654a1086daa04ddb0222fb6a390376ee6390a83d52abde50d8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads