a042cd826b86021078c17941337d63c37a92d2ae14eba4d635181f9ee1e003fb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8633aab973727f4cfd277c34aee257b2.exe
Size

24KB
MD5

8633aab973727f4cfd277c34aee257b2
SHA1

fcd56c1c9909eeda78b4c53af48f39beeac480e4
SHA256

a042cd826b86021078c17941337d63c37a92d2ae14eba4d635181f9ee1e003fb
SHA512

f181aaef3f08a8102f58ec1220aeec27c43e0b117e20d6788f50f4c8a446710fcc79ecc4d0ec4d47ea5192e9f1623c326a633a019b871b1b53a55ac156490fe7
SSDEEP

384:E3eVES+/xwGkRKJBLlM61qmTTMVF9/q5w0:bGS+ZfbJBLO8qYoAJ

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	8633aab973727f4cfd277c34aee257b2.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	8633aab973727f4cfd277c34aee257b2.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2792	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2704	ipconfig.exe
2824	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	tasklist.exe
Token: SeDebugPrivilege	2824	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2364	8633aab973727f4cfd277c34aee257b2.exe
2364	8633aab973727f4cfd277c34aee257b2.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 3044	2364	8633aab973727f4cfd277c34aee257b2.exe	28
PID 2364 wrote to memory of 3044	2364	8633aab973727f4cfd277c34aee257b2.exe	28
PID 2364 wrote to memory of 3044	2364	8633aab973727f4cfd277c34aee257b2.exe	28
PID 2364 wrote to memory of 3044	2364	8633aab973727f4cfd277c34aee257b2.exe	28
PID 3044 wrote to memory of 2672	3044	cmd.exe	30
PID 3044 wrote to memory of 2672	3044	cmd.exe	30
PID 3044 wrote to memory of 2672	3044	cmd.exe	30
PID 3044 wrote to memory of 2672	3044	cmd.exe	30
PID 3044 wrote to memory of 2704	3044	cmd.exe	31
PID 3044 wrote to memory of 2704	3044	cmd.exe	31
PID 3044 wrote to memory of 2704	3044	cmd.exe	31
PID 3044 wrote to memory of 2704	3044	cmd.exe	31
PID 3044 wrote to memory of 2792	3044	cmd.exe	32
PID 3044 wrote to memory of 2792	3044	cmd.exe	32
PID 3044 wrote to memory of 2792	3044	cmd.exe	32
PID 3044 wrote to memory of 2792	3044	cmd.exe	32
PID 3044 wrote to memory of 2868	3044	cmd.exe	35
PID 3044 wrote to memory of 2868	3044	cmd.exe	35
PID 3044 wrote to memory of 2868	3044	cmd.exe	35
PID 3044 wrote to memory of 2868	3044	cmd.exe	35
PID 2868 wrote to memory of 2592	2868	net.exe	34
PID 2868 wrote to memory of 2592	2868	net.exe	34
PID 2868 wrote to memory of 2592	2868	net.exe	34
PID 2868 wrote to memory of 2592	2868	net.exe	34
PID 3044 wrote to memory of 2824	3044	cmd.exe	36
PID 3044 wrote to memory of 2824	3044	cmd.exe	36
PID 3044 wrote to memory of 2824	3044	cmd.exe	36
PID 3044 wrote to memory of 2824	3044	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\8633aab973727f4cfd277c34aee257b2.exe
"C:\Users\Admin\AppData\Local\Temp\8633aab973727f4cfd277c34aee257b2.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2704
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
b585e613c9b1d173ece431697c3558df

SHA1
fed0b98cd80f75a2b94c834d583ce1028d34972f

SHA256
33348abf8724dfa8f318b0179b91ee162431f7157a98d2226f5240c60d565f2b

SHA512
479cd048b28f22b6c42e8e39a08b82eef6efd1de9787835dde2c16a07aa38ed043fd273fef1d81d3881780fe2b0207a6ea7861eb9aabc33388bc4fb7a0ce6b32

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads