10e96cc4ae381290b3fe076fe50af51faf628d0e28dc4d0e0002420a1a2723f7

Analysis

max time kernel
90s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cca7ff762749f627f2b5c49bf2ce3a1.exe
Size

24KB
MD5

7cca7ff762749f627f2b5c49bf2ce3a1
SHA1

ada9045ca06fbd30630be2d7bc6f13aff9e4f6d2
SHA256

10e96cc4ae381290b3fe076fe50af51faf628d0e28dc4d0e0002420a1a2723f7
SHA512

fef4c0f48b40f809f1ab5a423ad9f31a7b34d25802f784f450b0bb73daeb40e16e08763b5c8ef5a129b23c32d456c65738587d523dbe9df6819994689e4f7090
SSDEEP

384:E3eVES+/xwGkRKJDblM61qmTTMVF9/q570:bGS+ZfbJHO8qYoAQ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	7cca7ff762749f627f2b5c49bf2ce3a1.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	7cca7ff762749f627f2b5c49bf2ce3a1.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3844	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2120	ipconfig.exe
4248	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	tasklist.exe
Token: SeDebugPrivilege	4248	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4980	7cca7ff762749f627f2b5c49bf2ce3a1.exe
4980	7cca7ff762749f627f2b5c49bf2ce3a1.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 3480	4980	7cca7ff762749f627f2b5c49bf2ce3a1.exe	86
PID 4980 wrote to memory of 3480	4980	7cca7ff762749f627f2b5c49bf2ce3a1.exe	86
PID 4980 wrote to memory of 3480	4980	7cca7ff762749f627f2b5c49bf2ce3a1.exe	86
PID 3480 wrote to memory of 1076	3480	cmd.exe	88
PID 3480 wrote to memory of 1076	3480	cmd.exe	88
PID 3480 wrote to memory of 1076	3480	cmd.exe	88
PID 3480 wrote to memory of 2120	3480	cmd.exe	89
PID 3480 wrote to memory of 2120	3480	cmd.exe	89
PID 3480 wrote to memory of 2120	3480	cmd.exe	89
PID 3480 wrote to memory of 3844	3480	cmd.exe	91
PID 3480 wrote to memory of 3844	3480	cmd.exe	91
PID 3480 wrote to memory of 3844	3480	cmd.exe	91
PID 3480 wrote to memory of 3820	3480	cmd.exe	94
PID 3480 wrote to memory of 3820	3480	cmd.exe	94
PID 3480 wrote to memory of 3820	3480	cmd.exe	94
PID 3820 wrote to memory of 348	3820	net.exe	95
PID 3820 wrote to memory of 348	3820	net.exe	95
PID 3820 wrote to memory of 348	3820	net.exe	95
PID 3480 wrote to memory of 4248	3480	cmd.exe	96
PID 3480 wrote to memory of 4248	3480	cmd.exe	96
PID 3480 wrote to memory of 4248	3480	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\7cca7ff762749f627f2b5c49bf2ce3a1.exe
"C:\Users\Admin\AppData\Local\Temp\7cca7ff762749f627f2b5c49bf2ce3a1.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2120
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:348
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
c996084e8e5d3b584dd4c3706e2aacf9

SHA1
5c4c0383e19159a2ea4ffafd3e4e694be50f55a3

SHA256
db02e43fc48595fa9a404c8ebd11a906baf5938546199d124611022f1e1532a0

SHA512
edc00562564f623293523ea77812ad11412d341d9ada6835b341acd9790cf190b1853a3f554b12bd784a8ddf447cd2498486b43896063ff598d0916d2a163e71

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads