edb1de9a11fe25831a17e3f9a30db0c26694b7deb0da511f453250ff6dde32a0

Analysis

max time kernel
167s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 00:49

Target
4a38fd37be7971179634f1b4c1a02a7a.exe
Size 24KB
Sample240108-a6cehsadg7
SHA256 edb1de9a11fe25831a17e3f9a30db0c26694b7deb0da511f453250ff6dde32a0
MD5 4a38fd37be7971179634f1b4c1a02a7a
SHA1 84a7dffe20b550019ad741131d9534f775bdafed
SHA512 2cc6dcbf8f58a4361ffa1ed5cf398b2f86ae3df56f1dbc684136affcce9c2554118b19b1e0bb38d8b2e9b8463d1a041869b07d6f06dd543793dba4d63286ffa5
SSDEEP 384:E3eVES+/xwGkRKJA+zlM61qmTTMVF9/q5K0:bGS+ZfbJfzO8qYoA7
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	4a38fd37be7971179634f1b4c1a02a7a.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	4a38fd37be7971179634f1b4c1a02a7a.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
1844	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
4300	ipconfig.exe
804	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	tasklist.exe
Token: SeDebugPrivilege	804	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3452	4a38fd37be7971179634f1b4c1a02a7a.exe
3452	4a38fd37be7971179634f1b4c1a02a7a.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1076	3452	4a38fd37be7971179634f1b4c1a02a7a.exe	96
PID 3452 wrote to memory of 1076	3452	4a38fd37be7971179634f1b4c1a02a7a.exe	96
PID 3452 wrote to memory of 1076	3452	4a38fd37be7971179634f1b4c1a02a7a.exe	96
PID 1076 wrote to memory of 208	1076	cmd.exe	98
PID 1076 wrote to memory of 208	1076	cmd.exe	98
PID 1076 wrote to memory of 208	1076	cmd.exe	98
PID 1076 wrote to memory of 4300	1076	cmd.exe	99
PID 1076 wrote to memory of 4300	1076	cmd.exe	99
PID 1076 wrote to memory of 4300	1076	cmd.exe	99
PID 1076 wrote to memory of 1844	1076	cmd.exe	100
PID 1076 wrote to memory of 1844	1076	cmd.exe	100
PID 1076 wrote to memory of 1844	1076	cmd.exe	100
PID 1076 wrote to memory of 1364	1076	cmd.exe	103
PID 1076 wrote to memory of 1364	1076	cmd.exe	103
PID 1076 wrote to memory of 1364	1076	cmd.exe	103
PID 1364 wrote to memory of 4116	1364	net.exe	104
PID 1364 wrote to memory of 4116	1364	net.exe	104
PID 1364 wrote to memory of 4116	1364	net.exe	104
PID 1076 wrote to memory of 804	1076	cmd.exe	106
PID 1076 wrote to memory of 804	1076	cmd.exe	106
PID 1076 wrote to memory of 804	1076	cmd.exe	106