10e96cc4ae381290b3fe076fe50af51faf628d0e28dc4d0e0002420a1a2723f7

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cca7ff762749f627f2b5c49bf2ce3a1.exe
Size

24KB
MD5

7cca7ff762749f627f2b5c49bf2ce3a1
SHA1

ada9045ca06fbd30630be2d7bc6f13aff9e4f6d2
SHA256

10e96cc4ae381290b3fe076fe50af51faf628d0e28dc4d0e0002420a1a2723f7
SHA512

fef4c0f48b40f809f1ab5a423ad9f31a7b34d25802f784f450b0bb73daeb40e16e08763b5c8ef5a129b23c32d456c65738587d523dbe9df6819994689e4f7090
SSDEEP

384:E3eVES+/xwGkRKJDblM61qmTTMVF9/q570:bGS+ZfbJHO8qYoAQ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	7cca7ff762749f627f2b5c49bf2ce3a1.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	7cca7ff762749f627f2b5c49bf2ce3a1.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2872	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2724	ipconfig.exe
2908	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	tasklist.exe
Token: SeDebugPrivilege	2908	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	7cca7ff762749f627f2b5c49bf2ce3a1.exe
2988	7cca7ff762749f627f2b5c49bf2ce3a1.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2780	2988	7cca7ff762749f627f2b5c49bf2ce3a1.exe	28
PID 2988 wrote to memory of 2780	2988	7cca7ff762749f627f2b5c49bf2ce3a1.exe	28
PID 2988 wrote to memory of 2780	2988	7cca7ff762749f627f2b5c49bf2ce3a1.exe	28
PID 2988 wrote to memory of 2780	2988	7cca7ff762749f627f2b5c49bf2ce3a1.exe	28
PID 2780 wrote to memory of 2168	2780	cmd.exe	30
PID 2780 wrote to memory of 2168	2780	cmd.exe	30
PID 2780 wrote to memory of 2168	2780	cmd.exe	30
PID 2780 wrote to memory of 2168	2780	cmd.exe	30
PID 2780 wrote to memory of 2724	2780	cmd.exe	31
PID 2780 wrote to memory of 2724	2780	cmd.exe	31
PID 2780 wrote to memory of 2724	2780	cmd.exe	31
PID 2780 wrote to memory of 2724	2780	cmd.exe	31
PID 2780 wrote to memory of 2872	2780	cmd.exe	32
PID 2780 wrote to memory of 2872	2780	cmd.exe	32
PID 2780 wrote to memory of 2872	2780	cmd.exe	32
PID 2780 wrote to memory of 2872	2780	cmd.exe	32
PID 2780 wrote to memory of 2352	2780	cmd.exe	34
PID 2780 wrote to memory of 2352	2780	cmd.exe	34
PID 2780 wrote to memory of 2352	2780	cmd.exe	34
PID 2780 wrote to memory of 2352	2780	cmd.exe	34
PID 2352 wrote to memory of 3000	2352	net.exe	35
PID 2352 wrote to memory of 3000	2352	net.exe	35
PID 2352 wrote to memory of 3000	2352	net.exe	35
PID 2352 wrote to memory of 3000	2352	net.exe	35
PID 2780 wrote to memory of 2908	2780	cmd.exe	36
PID 2780 wrote to memory of 2908	2780	cmd.exe	36
PID 2780 wrote to memory of 2908	2780	cmd.exe	36
PID 2780 wrote to memory of 2908	2780	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\7cca7ff762749f627f2b5c49bf2ce3a1.exe
"C:\Users\Admin\AppData\Local\Temp\7cca7ff762749f627f2b5c49bf2ce3a1.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2724
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:3000
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
a6ac6bb7ffcdc993019e8dd5f9f38651

SHA1
c00f9bb289999e48de8010defbe18ee88310c86b

SHA256
38b6d112e9e39b1f2849f8a96401d548979224de44d005ac48dbe9e053ffc647

SHA512
7cfeb3d24d74a85ec1fc2e568ad31d9b6ac15d80016d37f96a5cebc348208d62f70735dc5bedf1c32b0b24c817861d6451c968e0b56a97c19be19050d6f9b25a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads