84d6d945a98db01ae1abec37847b48c503a6a7753c5866864476822ef21d678d

Analysis

max time kernel
140s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2024, 21:55

Target

7b61886a224f3266544023e0bcb0185b.exe
Size

24KB
MD5

7b61886a224f3266544023e0bcb0185b
SHA1

3e580f3b9b7e641e65d73d6b60011027c9953e81
SHA256

84d6d945a98db01ae1abec37847b48c503a6a7753c5866864476822ef21d678d
SHA512

ccb596d306197c75d2e70e0efb1cd564b2780dc6bb39d9314b77551abbb038b2faa112ca5c1cc30262ef795248da6c221a52f5efd9597f2fd6c0eb9d99870915
SSDEEP

384:E3eVES+/xwGkRKJ7S5lM61qmTTMVF9/q5G0:bGS+ZfbJ25O8qYoAv

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	7b61886a224f3266544023e0bcb0185b.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	7b61886a224f3266544023e0bcb0185b.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
1068	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
3008	ipconfig.exe
3036	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	tasklist.exe
Token: SeDebugPrivilege	3036	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4328	7b61886a224f3266544023e0bcb0185b.exe
4328	7b61886a224f3266544023e0bcb0185b.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4856	4328	7b61886a224f3266544023e0bcb0185b.exe	87
PID 4328 wrote to memory of 4856	4328	7b61886a224f3266544023e0bcb0185b.exe	87
PID 4328 wrote to memory of 4856	4328	7b61886a224f3266544023e0bcb0185b.exe	87
PID 4856 wrote to memory of 2704	4856	cmd.exe	90
PID 4856 wrote to memory of 2704	4856	cmd.exe	90
PID 4856 wrote to memory of 2704	4856	cmd.exe	90
PID 4856 wrote to memory of 3008	4856	cmd.exe	91
PID 4856 wrote to memory of 3008	4856	cmd.exe	91
PID 4856 wrote to memory of 3008	4856	cmd.exe	91
PID 4856 wrote to memory of 1068	4856	cmd.exe	92
PID 4856 wrote to memory of 1068	4856	cmd.exe	92
PID 4856 wrote to memory of 1068	4856	cmd.exe	92
PID 4856 wrote to memory of 2812	4856	cmd.exe	94
PID 4856 wrote to memory of 2812	4856	cmd.exe	94
PID 4856 wrote to memory of 2812	4856	cmd.exe	94
PID 2812 wrote to memory of 4116	2812	net.exe	95
PID 2812 wrote to memory of 4116	2812	net.exe	95
PID 2812 wrote to memory of 4116	2812	net.exe	95
PID 4856 wrote to memory of 3036	4856	cmd.exe	96
PID 4856 wrote to memory of 3036	4856	cmd.exe	96
PID 4856 wrote to memory of 3036	4856	cmd.exe	96