Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 00:05
Static task
static1
Behavioral task
behavioral1
Sample
97f74ab89f1e12ea31235bc5b5487fd2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97f74ab89f1e12ea31235bc5b5487fd2.exe
Resource
win10v2004-20231215-en
General
-
Target
97f74ab89f1e12ea31235bc5b5487fd2.exe
-
Size
24KB
-
MD5
97f74ab89f1e12ea31235bc5b5487fd2
-
SHA1
998213a53ac219d469d728c2fa59c65191505c13
-
SHA256
be3347386abed3b29361e677e859d99976d71195b9ef1eb81336a5f1e8d2d1c5
-
SHA512
61dc6149a803cf883bee09a0b5a960f18b1e5c7df4a9a36c869e26ac15b3f2afd5fbf925c6120d083f020cbcb9bffa0ad2f0522485555e043b13046dfbcf256a
-
SSDEEP
384:E3eVES+/xwGkRKJolM61qmTTMVF9/q5E0:bGS+ZfbJoO8qYoAl
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" 97f74ab89f1e12ea31235bc5b5487fd2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe 97f74ab89f1e12ea31235bc5b5487fd2.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3752 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4340 ipconfig.exe 1112 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3752 tasklist.exe Token: SeDebugPrivilege 1112 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1400 97f74ab89f1e12ea31235bc5b5487fd2.exe 1400 97f74ab89f1e12ea31235bc5b5487fd2.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1400 wrote to memory of 3684 1400 97f74ab89f1e12ea31235bc5b5487fd2.exe 84 PID 1400 wrote to memory of 3684 1400 97f74ab89f1e12ea31235bc5b5487fd2.exe 84 PID 1400 wrote to memory of 3684 1400 97f74ab89f1e12ea31235bc5b5487fd2.exe 84 PID 3684 wrote to memory of 888 3684 cmd.exe 86 PID 3684 wrote to memory of 888 3684 cmd.exe 86 PID 3684 wrote to memory of 888 3684 cmd.exe 86 PID 3684 wrote to memory of 4340 3684 cmd.exe 87 PID 3684 wrote to memory of 4340 3684 cmd.exe 87 PID 3684 wrote to memory of 4340 3684 cmd.exe 87 PID 3684 wrote to memory of 3752 3684 cmd.exe 88 PID 3684 wrote to memory of 3752 3684 cmd.exe 88 PID 3684 wrote to memory of 3752 3684 cmd.exe 88 PID 3684 wrote to memory of 3284 3684 cmd.exe 90 PID 3684 wrote to memory of 3284 3684 cmd.exe 90 PID 3684 wrote to memory of 3284 3684 cmd.exe 90 PID 3284 wrote to memory of 4272 3284 net.exe 91 PID 3284 wrote to memory of 4272 3284 net.exe 91 PID 3284 wrote to memory of 4272 3284 net.exe 91 PID 3684 wrote to memory of 1112 3684 cmd.exe 92 PID 3684 wrote to memory of 1112 3684 cmd.exe 92 PID 3684 wrote to memory of 1112 3684 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\97f74ab89f1e12ea31235bc5b5487fd2.exe"C:\Users\Admin\AppData\Local\Temp\97f74ab89f1e12ea31235bc5b5487fd2.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:888
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4340
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4272
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5ba0020d8a27614298eba7c366492a778
SHA1ddc9d2e4b2564c37d87e644693c7c3e106634a4b
SHA256dcf7b5ba9260b7cdb781afbacc67daa9161b9755996670ddacb9402311141716
SHA512754881f61b9756939abc0fcc349dcfa020048eba1518690d9025b43cc07ca7dddefb81415cb1ae9df0f3a78ddb5917b27f24a4982fbdb0e80700b1bcb2348c59