67d18efa7038e9e651fc5c7a9caf87df2275562a7c6d431dc12e42fbb596cccc

Analysis

max time kernel
0s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2024, 20:34

Target

518d0a0ea961119a9403ee30137e599e.exe
Size

24KB
MD5

518d0a0ea961119a9403ee30137e599e
SHA1

f0f21dbe6353787cffe6964e9c44b3175a5fa8c0
SHA256

67d18efa7038e9e651fc5c7a9caf87df2275562a7c6d431dc12e42fbb596cccc
SHA512

9817289926ee983627d4c8f45f22ea6abea41bd19afe2d05bbac3637bc849ce7ab01347d7d2f68a798c4c22d6ccaf5b7f2d96ca5316ae081c3862b49f6e3e700
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5+gg0:bGS+ZfbJiO8qYoA+m

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	518d0a0ea961119a9403ee30137e599e.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	518d0a0ea961119a9403ee30137e599e.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
3620	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
2760	NETSTAT.EXE
2076	ipconfig.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	518d0a0ea961119a9403ee30137e599e.exe
2824	518d0a0ea961119a9403ee30137e599e.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2396	2824	518d0a0ea961119a9403ee30137e599e.exe	16
PID 2824 wrote to memory of 2396	2824	518d0a0ea961119a9403ee30137e599e.exe	16
PID 2824 wrote to memory of 2396	2824	518d0a0ea961119a9403ee30137e599e.exe	16
PID 2396 wrote to memory of 4856	2396	cmd.exe	17
PID 2396 wrote to memory of 4856	2396	cmd.exe	17
PID 2396 wrote to memory of 4856	2396	cmd.exe	17
PID 2396 wrote to memory of 2076	2396	cmd.exe	26
PID 2396 wrote to memory of 2076	2396	cmd.exe	26
PID 2396 wrote to memory of 2076	2396	cmd.exe	26
PID 2396 wrote to memory of 3620	2396	cmd.exe	21
PID 2396 wrote to memory of 3620	2396	cmd.exe	21
PID 2396 wrote to memory of 3620	2396	cmd.exe	21
PID 2396 wrote to memory of 3656	2396	cmd.exe	22
PID 2396 wrote to memory of 3656	2396	cmd.exe	22
PID 2396 wrote to memory of 3656	2396	cmd.exe	22