e66264065923676807fd6d7b36f7c9dc52db9ef1c5399b2811738eb5e22a30f6 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 15:50

Sharing

Report Analysis Logs

General

Target

Desktop Goose v0.31/DesktopGoose v0.31/Close Goose.bat
Size

31B
MD5

1fdef6890e156b9aa7b662a4314dc712
SHA1

0c1e18150345fc43924c96844b8fd0fc53ec8855
SHA256

9d3b5a6370f076a57651fcf06fc4f3fbce8d9e5156642e22141a8f521f35ffdc
SHA512

474b7169f7a2deca1298391c42b0d5a8cb55b33853eaf1d79026c9b9b45d9a687582a0aa0d0ff639e5d9b40535cda3b3827546d26f1d35fa9169bcd73f050d29

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
2196	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2196	1256	cmd.exe	29
PID 1256 wrote to memory of 2196	1256	cmd.exe	29
PID 1256 wrote to memory of 2196	1256	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\Close Goose.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\taskkill.exe
  taskkill /f /im goosedesktop.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads