8d0f9fb52c87107b0a31f580a8b3e56aa353d387943bb3cd21f9fc834647ceb8

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98283b13d0a30dcd983d7b3572350538.exe
Size

24KB
MD5

98283b13d0a30dcd983d7b3572350538
SHA1

19122b454a378c57ffdbc5e748dee6fc86ddf44d
SHA256

8d0f9fb52c87107b0a31f580a8b3e56aa353d387943bb3cd21f9fc834647ceb8
SHA512

698419c5010ef04b2d0e46ceeae965056db1bbf0a36e7704f6737f69a3041339806e146f4c02ee201f5b34411a8b5b06bac0849c5363619e0a82d029cd42a347
SSDEEP

384:E3eVES+/xwGkRKJajl4slM61qmTTMVF9/q5I0:bGS+ZfbJajl4sO8qYoAx

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	98283b13d0a30dcd983d7b3572350538.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	98283b13d0a30dcd983d7b3572350538.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4356	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1816	ipconfig.exe
4436	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	tasklist.exe
Token: SeDebugPrivilege	4436	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3360	98283b13d0a30dcd983d7b3572350538.exe
3360	98283b13d0a30dcd983d7b3572350538.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 2204	3360	98283b13d0a30dcd983d7b3572350538.exe	85
PID 3360 wrote to memory of 2204	3360	98283b13d0a30dcd983d7b3572350538.exe	85
PID 3360 wrote to memory of 2204	3360	98283b13d0a30dcd983d7b3572350538.exe	85
PID 2204 wrote to memory of 4864	2204	cmd.exe	87
PID 2204 wrote to memory of 4864	2204	cmd.exe	87
PID 2204 wrote to memory of 4864	2204	cmd.exe	87
PID 2204 wrote to memory of 1816	2204	cmd.exe	88
PID 2204 wrote to memory of 1816	2204	cmd.exe	88
PID 2204 wrote to memory of 1816	2204	cmd.exe	88
PID 2204 wrote to memory of 4356	2204	cmd.exe	89
PID 2204 wrote to memory of 4356	2204	cmd.exe	89
PID 2204 wrote to memory of 4356	2204	cmd.exe	89
PID 2204 wrote to memory of 1440	2204	cmd.exe	91
PID 2204 wrote to memory of 1440	2204	cmd.exe	91
PID 2204 wrote to memory of 1440	2204	cmd.exe	91
PID 1440 wrote to memory of 4324	1440	net.exe	92
PID 1440 wrote to memory of 4324	1440	net.exe	92
PID 1440 wrote to memory of 4324	1440	net.exe	92
PID 2204 wrote to memory of 4436	2204	cmd.exe	93
PID 2204 wrote to memory of 4436	2204	cmd.exe	93
PID 2204 wrote to memory of 4436	2204	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\98283b13d0a30dcd983d7b3572350538.exe
"C:\Users\Admin\AppData\Local\Temp\98283b13d0a30dcd983d7b3572350538.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:4864
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1816
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:4324
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
b35c464adea21a3bdcaba621d4cb1ddd

SHA1
dd07b9869ab7b1ad77efe60e503626f8b19d73bc

SHA256
4376a237c38ba7650e0e6b44879eb6918d59543ee73cd939cf19d6bff6933220

SHA512
e1b4241921fb254506cc2d4414b7bb09b5404fe7e8f3481f258ec757dcded03dbe6306feee2f9251c2038552c0d80835cf5af7d8f287888d5eb1eb8d36a17c7e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads