993765b98aa22592942d300e7901c2c90dd20e5936e25cd5ea5ddedeff0574a2

Analysis

max time kernel
0s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

515a879f89f310bc64ed50b0de853875.exe
Size

24KB
MD5

515a879f89f310bc64ed50b0de853875
SHA1

d75e66cd8907cac51a7a7c17afce16a41ace5781
SHA256

993765b98aa22592942d300e7901c2c90dd20e5936e25cd5ea5ddedeff0574a2
SHA512

93c95183581583db963f28a3bba6f79354adb846d94a36ece5e60a1da3e2ffd6af0b74155d8a678e8659dc0659049654e7ebd5dbf593e5ab7863f8291193bd60
SSDEEP

384:E3eVES+/xwGkRKJyF8lM61qmTTMVF9/q5g0:bGS+ZfbJ7O8qYoAZ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	515a879f89f310bc64ed50b0de853875.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	515a879f89f310bc64ed50b0de853875.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2460	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2748	ipconfig.exe
4664	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2460	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4964	515a879f89f310bc64ed50b0de853875.exe
4964	515a879f89f310bc64ed50b0de853875.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 2904	4964	515a879f89f310bc64ed50b0de853875.exe	28
PID 4964 wrote to memory of 2904	4964	515a879f89f310bc64ed50b0de853875.exe	28
PID 4964 wrote to memory of 2904	4964	515a879f89f310bc64ed50b0de853875.exe	28
PID 2904 wrote to memory of 2408	2904	cmd.exe	18
PID 2904 wrote to memory of 2408	2904	cmd.exe	18
PID 2904 wrote to memory of 2408	2904	cmd.exe	18
PID 2904 wrote to memory of 2748	2904	cmd.exe	19
PID 2904 wrote to memory of 2748	2904	cmd.exe	19
PID 2904 wrote to memory of 2748	2904	cmd.exe	19
PID 2904 wrote to memory of 2460	2904	cmd.exe	20
PID 2904 wrote to memory of 2460	2904	cmd.exe	20
PID 2904 wrote to memory of 2460	2904	cmd.exe	20

C:\Users\Admin\AppData\Local\Temp\515a879f89f310bc64ed50b0de853875.exe
"C:\Users\Admin\AppData\Local\Temp\515a879f89f310bc64ed50b0de853875.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904

C:\Windows\SysWOW64\cmd.exe
cmd /c set
1⤵
PID:2408

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
1⤵
- Gathers network information
PID:2748

C:\Windows\SysWOW64\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start
1⤵
PID:3716

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -an
1⤵
- Gathers network information
PID:4664

C:\Windows\SysWOW64\net.exe
net start
1⤵
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
15KB

MD5
c534088f70a94d483d3c5a77219ffa24

SHA1
de068d5641923c1fb42dfab4ac6ec92e69ec2cc6

SHA256
1fe2d99ad5c4670c7cfa0380533b84bedb16f898bc073ce12a96006c37bb222e

SHA512
25c47e763896652d4578e5d826e6e4ba2253edb7c0540cd3e467ddc7dda5fe03ca4eaa08c9cadd8cfab6140a880b0950563887365c035f35c9124a06ff6ce128

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads