8411c715d28a942febfd7888b1544520d3a3f2eab7af50dc30c4042a7b5e22ba

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4efcfc138874ab01932ba5741fc6f87b.exe
Size

24KB
MD5

4efcfc138874ab01932ba5741fc6f87b
SHA1

91550ec50386ac6210b6d4fdc26b5333ccd2de5c
SHA256

8411c715d28a942febfd7888b1544520d3a3f2eab7af50dc30c4042a7b5e22ba
SHA512

01e1fb5e9e0549f6838eeb1692e0eafa3946ff0286db85ee4a1737b0afc4985e1615893195e84e847012d736153a5cb26c21ba9c21b129ca94cfa24408256044
SSDEEP

384:E3eVES+/xwGkRKJ1b7lM61qmTTMVF9/q5a0:bGS+ZfbJ1fO8qYoAr

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	4efcfc138874ab01932ba5741fc6f87b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	4efcfc138874ab01932ba5741fc6f87b.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2800	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2392	ipconfig.exe
2908	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	tasklist.exe
Token: SeDebugPrivilege	2908	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	4efcfc138874ab01932ba5741fc6f87b.exe
2244	4efcfc138874ab01932ba5741fc6f87b.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2864	2244	4efcfc138874ab01932ba5741fc6f87b.exe	28
PID 2244 wrote to memory of 2864	2244	4efcfc138874ab01932ba5741fc6f87b.exe	28
PID 2244 wrote to memory of 2864	2244	4efcfc138874ab01932ba5741fc6f87b.exe	28
PID 2244 wrote to memory of 2864	2244	4efcfc138874ab01932ba5741fc6f87b.exe	28
PID 2864 wrote to memory of 2676	2864	cmd.exe	30
PID 2864 wrote to memory of 2676	2864	cmd.exe	30
PID 2864 wrote to memory of 2676	2864	cmd.exe	30
PID 2864 wrote to memory of 2676	2864	cmd.exe	30
PID 2864 wrote to memory of 2392	2864	cmd.exe	31
PID 2864 wrote to memory of 2392	2864	cmd.exe	31
PID 2864 wrote to memory of 2392	2864	cmd.exe	31
PID 2864 wrote to memory of 2392	2864	cmd.exe	31
PID 2864 wrote to memory of 2800	2864	cmd.exe	32
PID 2864 wrote to memory of 2800	2864	cmd.exe	32
PID 2864 wrote to memory of 2800	2864	cmd.exe	32
PID 2864 wrote to memory of 2800	2864	cmd.exe	32
PID 2864 wrote to memory of 2716	2864	cmd.exe	34
PID 2864 wrote to memory of 2716	2864	cmd.exe	34
PID 2864 wrote to memory of 2716	2864	cmd.exe	34
PID 2864 wrote to memory of 2716	2864	cmd.exe	34
PID 2716 wrote to memory of 2592	2716	net.exe	35
PID 2716 wrote to memory of 2592	2716	net.exe	35
PID 2716 wrote to memory of 2592	2716	net.exe	35
PID 2716 wrote to memory of 2592	2716	net.exe	35
PID 2864 wrote to memory of 2908	2864	cmd.exe	36
PID 2864 wrote to memory of 2908	2864	cmd.exe	36
PID 2864 wrote to memory of 2908	2864	cmd.exe	36
PID 2864 wrote to memory of 2908	2864	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\4efcfc138874ab01932ba5741fc6f87b.exe
"C:\Users\Admin\AppData\Local\Temp\4efcfc138874ab01932ba5741fc6f87b.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2392
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2592
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
4d10f794036c3391acb1d378511c1be4

SHA1
d6941ed3971824db81095b4a60ffbd5b17ac7cd0

SHA256
832d054fd4663b91522273a584198f6edcf2e40e543ff45d9a92f12c4c9d6162

SHA512
1b95fd40ff905d187addaa8fb267d1f0500703d1ca49ee4686bde73aa5e5a8cc15523616ad04d9cac1d8360706ed241421c80d4b1272b9bf3a7a5b935e60e180

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads