8411c715d28a942febfd7888b1544520d3a3f2eab7af50dc30c4042a7b5e22ba

Analysis

max time kernel
197s
max time network
213s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 19:14

Target

4efcfc138874ab01932ba5741fc6f87b.exe
Size

24KB
MD5

4efcfc138874ab01932ba5741fc6f87b
SHA1

91550ec50386ac6210b6d4fdc26b5333ccd2de5c
SHA256

8411c715d28a942febfd7888b1544520d3a3f2eab7af50dc30c4042a7b5e22ba
SHA512

01e1fb5e9e0549f6838eeb1692e0eafa3946ff0286db85ee4a1737b0afc4985e1615893195e84e847012d736153a5cb26c21ba9c21b129ca94cfa24408256044
SSDEEP

384:E3eVES+/xwGkRKJ1b7lM61qmTTMVF9/q5a0:bGS+ZfbJ1fO8qYoAr

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	4efcfc138874ab01932ba5741fc6f87b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	4efcfc138874ab01932ba5741fc6f87b.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
1936	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
3316	ipconfig.exe
3752	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	tasklist.exe
Token: SeDebugPrivilege	3752	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3084	4efcfc138874ab01932ba5741fc6f87b.exe
3084	4efcfc138874ab01932ba5741fc6f87b.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 2000	3084	4efcfc138874ab01932ba5741fc6f87b.exe	91
PID 3084 wrote to memory of 2000	3084	4efcfc138874ab01932ba5741fc6f87b.exe	91
PID 3084 wrote to memory of 2000	3084	4efcfc138874ab01932ba5741fc6f87b.exe	91
PID 2000 wrote to memory of 4812	2000	cmd.exe	94
PID 2000 wrote to memory of 4812	2000	cmd.exe	94
PID 2000 wrote to memory of 4812	2000	cmd.exe	94
PID 2000 wrote to memory of 3316	2000	cmd.exe	95
PID 2000 wrote to memory of 3316	2000	cmd.exe	95
PID 2000 wrote to memory of 3316	2000	cmd.exe	95
PID 2000 wrote to memory of 1936	2000	cmd.exe	96
PID 2000 wrote to memory of 1936	2000	cmd.exe	96
PID 2000 wrote to memory of 1936	2000	cmd.exe	96
PID 2000 wrote to memory of 3756	2000	cmd.exe	97
PID 2000 wrote to memory of 3756	2000	cmd.exe	97
PID 2000 wrote to memory of 3756	2000	cmd.exe	97
PID 3756 wrote to memory of 1516	3756	net.exe	98
PID 3756 wrote to memory of 1516	3756	net.exe	98
PID 3756 wrote to memory of 1516	3756	net.exe	98
PID 2000 wrote to memory of 3752	2000	cmd.exe	100
PID 2000 wrote to memory of 3752	2000	cmd.exe	100
PID 2000 wrote to memory of 3752	2000	cmd.exe	100