1c79304f385b81d350f0f1b7f5e1c7482de821692c11b7f2aa4004f4c1441e2c

Analysis

max time kernel
190s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 01:10

Target

426252c515d5ff697411cdf5a1985bab.exe
Size

24KB
MD5

426252c515d5ff697411cdf5a1985bab
SHA1

c630095571931a4d30c363eb982eeb583b3b3554
SHA256

1c79304f385b81d350f0f1b7f5e1c7482de821692c11b7f2aa4004f4c1441e2c
SHA512

2ce821ca5bd26b6ab54ea494508dddb0ccb207e5d7b76d59fd62bd17aaad175e458d197d5082236aa7962a8a445b2c7c382ac0b7afe3a6412719b9af194ed1f8
SSDEEP

384:E3eVES+/xwGkRKJQZlM61qmTTMVF9/q570:bGS+ZfbJWO8qYoAQ

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	426252c515d5ff697411cdf5a1985bab.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	426252c515d5ff697411cdf5a1985bab.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
1944	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
468	ipconfig.exe
1856	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	tasklist.exe
Token: SeDebugPrivilege	1856	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3260	426252c515d5ff697411cdf5a1985bab.exe
3260	426252c515d5ff697411cdf5a1985bab.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3320	3260	426252c515d5ff697411cdf5a1985bab.exe	88
PID 3260 wrote to memory of 3320	3260	426252c515d5ff697411cdf5a1985bab.exe	88
PID 3260 wrote to memory of 3320	3260	426252c515d5ff697411cdf5a1985bab.exe	88
PID 3320 wrote to memory of 3396	3320	cmd.exe	91
PID 3320 wrote to memory of 3396	3320	cmd.exe	91
PID 3320 wrote to memory of 3396	3320	cmd.exe	91
PID 3320 wrote to memory of 468	3320	cmd.exe	93
PID 3320 wrote to memory of 468	3320	cmd.exe	93
PID 3320 wrote to memory of 468	3320	cmd.exe	93
PID 3320 wrote to memory of 1944	3320	cmd.exe	94
PID 3320 wrote to memory of 1944	3320	cmd.exe	94
PID 3320 wrote to memory of 1944	3320	cmd.exe	94
PID 3320 wrote to memory of 4284	3320	cmd.exe	96
PID 3320 wrote to memory of 4284	3320	cmd.exe	96
PID 3320 wrote to memory of 4284	3320	cmd.exe	96
PID 4284 wrote to memory of 2920	4284	net.exe	97
PID 4284 wrote to memory of 2920	4284	net.exe	97
PID 4284 wrote to memory of 2920	4284	net.exe	97
PID 3320 wrote to memory of 1856	3320	cmd.exe	98
PID 3320 wrote to memory of 1856	3320	cmd.exe	98
PID 3320 wrote to memory of 1856	3320	cmd.exe	98