98e598bb032d1a79674c2750145420c25478ce7f6d38732921e8208979212c0b

Analysis

max time kernel
146s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 12:40

Target

40e30893fffd8d3add2c9bf05b090787.exe
Size

24KB
MD5

40e30893fffd8d3add2c9bf05b090787
SHA1

372e63c8bdc4da260d0181a76a338a819a90e735
SHA256

98e598bb032d1a79674c2750145420c25478ce7f6d38732921e8208979212c0b
SHA512

5075a748d98e83f96c852d16006fa3db516d64cb61b6dff3aa9e6738e6085fcd657e4bd448a7192a4e8bbe5ce53484a62ff463dfd11ae8753dfb77ab2fe8cf16
SSDEEP

384:E3eVES+/xwGkRKJolM61qmTTMVF9/q5h0:bGS+ZfbJoO8qYoA+

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	40e30893fffd8d3add2c9bf05b090787.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	40e30893fffd8d3add2c9bf05b090787.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
2452	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
4888	ipconfig.exe
1764	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2452	tasklist.exe
Token: SeDebugPrivilege	1764	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4920	40e30893fffd8d3add2c9bf05b090787.exe
4920	40e30893fffd8d3add2c9bf05b090787.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4976	4920	40e30893fffd8d3add2c9bf05b090787.exe	95
PID 4920 wrote to memory of 4976	4920	40e30893fffd8d3add2c9bf05b090787.exe	95
PID 4920 wrote to memory of 4976	4920	40e30893fffd8d3add2c9bf05b090787.exe	95
PID 4976 wrote to memory of 3896	4976	cmd.exe	97
PID 4976 wrote to memory of 3896	4976	cmd.exe	97
PID 4976 wrote to memory of 3896	4976	cmd.exe	97
PID 4976 wrote to memory of 4888	4976	cmd.exe	98
PID 4976 wrote to memory of 4888	4976	cmd.exe	98
PID 4976 wrote to memory of 4888	4976	cmd.exe	98
PID 4976 wrote to memory of 2452	4976	cmd.exe	99
PID 4976 wrote to memory of 2452	4976	cmd.exe	99
PID 4976 wrote to memory of 2452	4976	cmd.exe	99
PID 4976 wrote to memory of 3788	4976	cmd.exe	100
PID 4976 wrote to memory of 3788	4976	cmd.exe	100
PID 4976 wrote to memory of 3788	4976	cmd.exe	100
PID 3788 wrote to memory of 444	3788	net.exe	102
PID 3788 wrote to memory of 444	3788	net.exe	102
PID 3788 wrote to memory of 444	3788	net.exe	102
PID 4976 wrote to memory of 1764	4976	cmd.exe	103
PID 4976 wrote to memory of 1764	4976	cmd.exe	103
PID 4976 wrote to memory of 1764	4976	cmd.exe	103