e69625526df5a046f8c8b258025c1d5f79786ee1661288d9bbb1326b9dc67822

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bd70e23d2370432d65ca88d4c5a1b0c.exe
Size

24KB
MD5

5bd70e23d2370432d65ca88d4c5a1b0c
SHA1

4c6913e1a81815cba4954218c4044077b21645b1
SHA256

e69625526df5a046f8c8b258025c1d5f79786ee1661288d9bbb1326b9dc67822
SHA512

ba55bbafe08b01b94d008a6b8c9414eec07d344b41859d75a0a58ac9deedc394f351b3cf6e430fb07811e2821f76e4bd92e626dc38c4abf48e0b9c53671d410d
SSDEEP

384:E3eVES+/xwGkRKJ7lM61qmTTMVF9/q5V0:bGS+ZfbJ7O8qYoA6

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	5bd70e23d2370432d65ca88d4c5a1b0c.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	5bd70e23d2370432d65ca88d4c5a1b0c.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1840	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3164	NETSTAT.EXE
1512	ipconfig.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	tasklist.exe
Token: SeDebugPrivilege	3164	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4740	5bd70e23d2370432d65ca88d4c5a1b0c.exe
4740	5bd70e23d2370432d65ca88d4c5a1b0c.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2656	4740	5bd70e23d2370432d65ca88d4c5a1b0c.exe	29
PID 4740 wrote to memory of 2656	4740	5bd70e23d2370432d65ca88d4c5a1b0c.exe	29
PID 4740 wrote to memory of 2656	4740	5bd70e23d2370432d65ca88d4c5a1b0c.exe	29
PID 2656 wrote to memory of 4040	2656	cmd.exe	32
PID 2656 wrote to memory of 4040	2656	cmd.exe	32
PID 2656 wrote to memory of 4040	2656	cmd.exe	32
PID 2656 wrote to memory of 1512	2656	cmd.exe	31
PID 2656 wrote to memory of 1512	2656	cmd.exe	31
PID 2656 wrote to memory of 1512	2656	cmd.exe	31
PID 2656 wrote to memory of 1840	2656	cmd.exe	33
PID 2656 wrote to memory of 1840	2656	cmd.exe	33
PID 2656 wrote to memory of 1840	2656	cmd.exe	33
PID 2656 wrote to memory of 2416	2656	cmd.exe	51
PID 2656 wrote to memory of 2416	2656	cmd.exe	51
PID 2656 wrote to memory of 2416	2656	cmd.exe	51
PID 2416 wrote to memory of 2288	2416	net.exe	53
PID 2416 wrote to memory of 2288	2416	net.exe	53
PID 2416 wrote to memory of 2288	2416	net.exe	53
PID 2656 wrote to memory of 3164	2656	cmd.exe	52
PID 2656 wrote to memory of 3164	2656	cmd.exe	52
PID 2656 wrote to memory of 3164	2656	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\5bd70e23d2370432d65ca88d4c5a1b0c.exe
"C:\Users\Admin\AppData\Local\Temp\5bd70e23d2370432d65ca88d4c5a1b0c.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:4040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2288
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
15KB

MD5
6eb82e22b593053cf8fcaf0f6e484a73

SHA1
22622f985e94e10e7e7a4c4b72fbf61ad166ff85

SHA256
cbcfe53b0fe81b696a463743a6e8641837b816d27d959fe504081d5155ef5ef6

SHA512
249df42ae84e3178dab6e3077c0d50fbe18d82fda584db0b779ad8dbcd1414b654e8eaeaeb7959488f21d269d6e49e119c6388579e94057546d95f8f10cb106c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads