198597b7db8721407a106b440a7503ce8ba47295a45daa0db134deec92dea45b

Analysis

max time kernel
0s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43f0682f83485ae3dd505a8e916b409e.exe
Size

24KB
MD5

43f0682f83485ae3dd505a8e916b409e
SHA1

e412feb81968ecc86d5df83d5b1ce4940bc00ee6
SHA256

198597b7db8721407a106b440a7503ce8ba47295a45daa0db134deec92dea45b
SHA512

fc9c0efd9a0281e4d5b96b88d4135caf4b6518e5dee3c43e4cebc38452bd77cd6db16dcd710922701c65206f616d3e415c47e8b31e652a1f4b95397f6aff97ea
SSDEEP

384:E3eVES+/xwGkRKJ5RMlM61qmTTMVF9/q5G0:bGS+ZfbJ5RMO8qYoAv

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	43f0682f83485ae3dd505a8e916b409e.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	43f0682f83485ae3dd505a8e916b409e.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2216	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2944	ipconfig.exe
1924	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
532	43f0682f83485ae3dd505a8e916b409e.exe
532	43f0682f83485ae3dd505a8e916b409e.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 1456	532	43f0682f83485ae3dd505a8e916b409e.exe	28
PID 532 wrote to memory of 1456	532	43f0682f83485ae3dd505a8e916b409e.exe	28
PID 532 wrote to memory of 1456	532	43f0682f83485ae3dd505a8e916b409e.exe	28
PID 1456 wrote to memory of 2396	1456	cmd.exe	18
PID 1456 wrote to memory of 2396	1456	cmd.exe	18
PID 1456 wrote to memory of 2396	1456	cmd.exe	18
PID 1456 wrote to memory of 2944	1456	cmd.exe	19
PID 1456 wrote to memory of 2944	1456	cmd.exe	19
PID 1456 wrote to memory of 2944	1456	cmd.exe	19
PID 1456 wrote to memory of 2216	1456	cmd.exe	23
PID 1456 wrote to memory of 2216	1456	cmd.exe	23
PID 1456 wrote to memory of 2216	1456	cmd.exe	23

C:\Users\Admin\AppData\Local\Temp\43f0682f83485ae3dd505a8e916b409e.exe
"C:\Users\Admin\AppData\Local\Temp\43f0682f83485ae3dd505a8e916b409e.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456

C:\Windows\SysWOW64\cmd.exe
cmd /c set
1⤵
PID:2396

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
1⤵
- Gathers network information
PID:2944

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2216

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -an
1⤵
- Gathers network information
PID:1924

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start
1⤵
PID:4820

C:\Windows\SysWOW64\net.exe
net start
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
60d659f1e9526145ba2e508fec0a9069

SHA1
add12bb829054f6c459365df6724cd0ed62bf426

SHA256
a9797ae0ca0682f96fe979e7409f1d70f0233a8d9b324b7f12ee1636571b5a2f

SHA512
b426c97a3c13563d765c383cbb818f8fe8c65af89193665a05b156abb1ffd1e854c1a6ba355c96da59f30c0d20ef9aa263fbdfd1d891a23b1dff88f9b58546ad

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads