1c442dbc48a08bd1a39d9256b66552897e46ea69f6a213f07dd571eeec3aab77

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8abd5b21d76b36cea2689c12831d95f.exe
Size

24KB
MD5

b8abd5b21d76b36cea2689c12831d95f
SHA1

d74c2aa908545f4ca326147884dfaba305b2ec82
SHA256

1c442dbc48a08bd1a39d9256b66552897e46ea69f6a213f07dd571eeec3aab77
SHA512

39ec4587500220941a08cd9619e318a5cbb7b3373c38a5e6248177d5dd163fc9a3ffb4ae7a43902e64b8d79f1bef6d17b1dfb9270fbb572835d1fc018c8d908f
SSDEEP

384:E3eVES+/xwGkRKJo+lM61qmTTMVF9/q5V0:bGS+ZfbJXO8qYoA6

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	b8abd5b21d76b36cea2689c12831d95f.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	b8abd5b21d76b36cea2689c12831d95f.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1560	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2304	ipconfig.exe
2752	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	2752	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2236	b8abd5b21d76b36cea2689c12831d95f.exe
2236	b8abd5b21d76b36cea2689c12831d95f.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1524	2236	b8abd5b21d76b36cea2689c12831d95f.exe	28
PID 2236 wrote to memory of 1524	2236	b8abd5b21d76b36cea2689c12831d95f.exe	28
PID 2236 wrote to memory of 1524	2236	b8abd5b21d76b36cea2689c12831d95f.exe	28
PID 2236 wrote to memory of 1524	2236	b8abd5b21d76b36cea2689c12831d95f.exe	28
PID 1524 wrote to memory of 2188	1524	cmd.exe	30
PID 1524 wrote to memory of 2188	1524	cmd.exe	30
PID 1524 wrote to memory of 2188	1524	cmd.exe	30
PID 1524 wrote to memory of 2188	1524	cmd.exe	30
PID 1524 wrote to memory of 2304	1524	cmd.exe	31
PID 1524 wrote to memory of 2304	1524	cmd.exe	31
PID 1524 wrote to memory of 2304	1524	cmd.exe	31
PID 1524 wrote to memory of 2304	1524	cmd.exe	31
PID 1524 wrote to memory of 1560	1524	cmd.exe	32
PID 1524 wrote to memory of 1560	1524	cmd.exe	32
PID 1524 wrote to memory of 1560	1524	cmd.exe	32
PID 1524 wrote to memory of 1560	1524	cmd.exe	32
PID 1524 wrote to memory of 3020	1524	cmd.exe	34
PID 1524 wrote to memory of 3020	1524	cmd.exe	34
PID 1524 wrote to memory of 3020	1524	cmd.exe	34
PID 1524 wrote to memory of 3020	1524	cmd.exe	34
PID 3020 wrote to memory of 3040	3020	net.exe	35
PID 3020 wrote to memory of 3040	3020	net.exe	35
PID 3020 wrote to memory of 3040	3020	net.exe	35
PID 3020 wrote to memory of 3040	3020	net.exe	35
PID 1524 wrote to memory of 2752	1524	cmd.exe	36
PID 1524 wrote to memory of 2752	1524	cmd.exe	36
PID 1524 wrote to memory of 2752	1524	cmd.exe	36
PID 1524 wrote to memory of 2752	1524	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\b8abd5b21d76b36cea2689c12831d95f.exe
"C:\Users\Admin\AppData\Local\Temp\b8abd5b21d76b36cea2689c12831d95f.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2304
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:3040
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
f946c4167854164175d5181a9117e140

SHA1
04a19328c5fc73a1eda18c679e61bafc6e7a7bac

SHA256
97c5425f98bf9e2bba53cb98ea0a03853cf60addb7d2706f469e078472c86cd2

SHA512
63563b61927cdc99faad2f25aecbafa194370b6ee8624d230ec1861dedb7357453b55c611a0d2e162c8eb90e4a2e6a5968d60efe602eb5a7b4e4a22be63df53d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads