421864315f6525ef3d0e05235df8e41def06b3c68a8e9dd348b599d36ea6db4e

Analysis

max time kernel
130s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2024 08:07

Target

432f3dd06ac2659df71f127751716913.exe
Size

24KB
MD5

432f3dd06ac2659df71f127751716913
SHA1

3eed9027a6b3151544f3cfd205d9fda0c222ea8d
SHA256

421864315f6525ef3d0e05235df8e41def06b3c68a8e9dd348b599d36ea6db4e
SHA512

9838daed3340b718b8db0235768af390e9eb2c53b6986dade1d12640ace6bbaddbeb529ab8fa3761ab7f32e6950ce9f43285ef6b632748e07ca2bf8b56401a7e
SSDEEP

384:E3eVES+/xwGkRKJrtwmI9lM61qmTTMVF9/q5B0:bGS+ZfbJrhI9O8qYoAe

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	432f3dd06ac2659df71f127751716913.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	432f3dd06ac2659df71f127751716913.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
732	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
4928	ipconfig.exe
4256	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	732	tasklist.exe
Token: SeDebugPrivilege	4256	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1640	432f3dd06ac2659df71f127751716913.exe
1640	432f3dd06ac2659df71f127751716913.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 756	1640	432f3dd06ac2659df71f127751716913.exe	90
PID 1640 wrote to memory of 756	1640	432f3dd06ac2659df71f127751716913.exe	90
PID 1640 wrote to memory of 756	1640	432f3dd06ac2659df71f127751716913.exe	90
PID 756 wrote to memory of 768	756	cmd.exe	92
PID 756 wrote to memory of 768	756	cmd.exe	92
PID 756 wrote to memory of 768	756	cmd.exe	92
PID 756 wrote to memory of 4928	756	cmd.exe	93
PID 756 wrote to memory of 4928	756	cmd.exe	93
PID 756 wrote to memory of 4928	756	cmd.exe	93
PID 756 wrote to memory of 732	756	cmd.exe	94
PID 756 wrote to memory of 732	756	cmd.exe	94
PID 756 wrote to memory of 732	756	cmd.exe	94
PID 756 wrote to memory of 3272	756	cmd.exe	96
PID 756 wrote to memory of 3272	756	cmd.exe	96
PID 756 wrote to memory of 3272	756	cmd.exe	96
PID 3272 wrote to memory of 3768	3272	net.exe	97
PID 3272 wrote to memory of 3768	3272	net.exe	97
PID 3272 wrote to memory of 3768	3272	net.exe	97
PID 756 wrote to memory of 4256	756	cmd.exe	98
PID 756 wrote to memory of 4256	756	cmd.exe	98
PID 756 wrote to memory of 4256	756	cmd.exe	98