fc7729d12d10d8cb2fb8e9bddd4628f6c8b3848b861043eaa89c83a1bee3b1bb

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 23:33

Target

b5f03595e1922db88ddbfa8334699ab5.exe
Size

24KB
MD5

b5f03595e1922db88ddbfa8334699ab5
SHA1

f80eef1cfee83c2ae4ea192d4d9fffc942cfa723
SHA256

fc7729d12d10d8cb2fb8e9bddd4628f6c8b3848b861043eaa89c83a1bee3b1bb
SHA512

dffc5f22a5c3a0bd33b41211b11e0fd15ad708b984db1780f0be418b420b8ea207c290de93569895551470627a17e22f5ab2b4446adb070256f172eb456d0324
SSDEEP

384:E3eVES+/xwGkRKJyhoFlM61qmTTMVF9/q5lm0:bGS+ZfbJ+YO8qYoAB

Score

6^/10

persistence

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	b5f03595e1922db88ddbfa8334699ab5.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	b5f03595e1922db88ddbfa8334699ab5.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

pid	Process
5044	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

pid	Process
1352	ipconfig.exe
2732	NETSTAT.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	tasklist.exe
Token: SeDebugPrivilege	2732	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3724	b5f03595e1922db88ddbfa8334699ab5.exe
3724	b5f03595e1922db88ddbfa8334699ab5.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3608	3724	b5f03595e1922db88ddbfa8334699ab5.exe	96
PID 3724 wrote to memory of 3608	3724	b5f03595e1922db88ddbfa8334699ab5.exe	96
PID 3724 wrote to memory of 3608	3724	b5f03595e1922db88ddbfa8334699ab5.exe	96
PID 3608 wrote to memory of 2784	3608	cmd.exe	98
PID 3608 wrote to memory of 2784	3608	cmd.exe	98
PID 3608 wrote to memory of 2784	3608	cmd.exe	98
PID 3608 wrote to memory of 1352	3608	cmd.exe	99
PID 3608 wrote to memory of 1352	3608	cmd.exe	99
PID 3608 wrote to memory of 1352	3608	cmd.exe	99
PID 3608 wrote to memory of 5044	3608	cmd.exe	100
PID 3608 wrote to memory of 5044	3608	cmd.exe	100
PID 3608 wrote to memory of 5044	3608	cmd.exe	100
PID 3608 wrote to memory of 1628	3608	cmd.exe	102
PID 3608 wrote to memory of 1628	3608	cmd.exe	102
PID 3608 wrote to memory of 1628	3608	cmd.exe	102
PID 1628 wrote to memory of 3700	1628	net.exe	103
PID 1628 wrote to memory of 3700	1628	net.exe	103
PID 1628 wrote to memory of 3700	1628	net.exe	103
PID 3608 wrote to memory of 2732	3608	cmd.exe	104
PID 3608 wrote to memory of 2732	3608	cmd.exe	104
PID 3608 wrote to memory of 2732	3608	cmd.exe	104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3640 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:1988