d633ec26505d322cf84084a3d8fcc68b3d82188435ef260ab3e6c467d5a3c1fe

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3906e8ec3001cbfa355e83026573843.exe
Size

24KB
MD5

c3906e8ec3001cbfa355e83026573843
SHA1

48d4831761947e0deb24e6115eae6604c5ade957
SHA256

d633ec26505d322cf84084a3d8fcc68b3d82188435ef260ab3e6c467d5a3c1fe
SHA512

150ea14e370031d41646c7b2b7d5dfa81afc76fccf3b5090a50bfd09f07c2cde75f1ae0c9c17f271c107c181d2d5bef64f6af094f3f765373e5398ce109fcf7f
SSDEEP

384:E3eVES+/xwGkRKJolM61qmTTMVF9/q530:bGS+ZfbJoO8qYoAk

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	c3906e8ec3001cbfa355e83026573843.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	c3906e8ec3001cbfa355e83026573843.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4200	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4088	ipconfig.exe
3872	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	tasklist.exe
Token: SeDebugPrivilege	3872	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4856	c3906e8ec3001cbfa355e83026573843.exe
4856	c3906e8ec3001cbfa355e83026573843.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 1928	4856	c3906e8ec3001cbfa355e83026573843.exe	91
PID 4856 wrote to memory of 1928	4856	c3906e8ec3001cbfa355e83026573843.exe	91
PID 4856 wrote to memory of 1928	4856	c3906e8ec3001cbfa355e83026573843.exe	91
PID 1928 wrote to memory of 3760	1928	cmd.exe	93
PID 1928 wrote to memory of 3760	1928	cmd.exe	93
PID 1928 wrote to memory of 3760	1928	cmd.exe	93
PID 1928 wrote to memory of 4088	1928	cmd.exe	95
PID 1928 wrote to memory of 4088	1928	cmd.exe	95
PID 1928 wrote to memory of 4088	1928	cmd.exe	95
PID 1928 wrote to memory of 4200	1928	cmd.exe	96
PID 1928 wrote to memory of 4200	1928	cmd.exe	96
PID 1928 wrote to memory of 4200	1928	cmd.exe	96
PID 1928 wrote to memory of 1888	1928	cmd.exe	99
PID 1928 wrote to memory of 1888	1928	cmd.exe	99
PID 1928 wrote to memory of 1888	1928	cmd.exe	99
PID 1888 wrote to memory of 5008	1888	net.exe	100
PID 1888 wrote to memory of 5008	1888	net.exe	100
PID 1888 wrote to memory of 5008	1888	net.exe	100
PID 1928 wrote to memory of 3872	1928	cmd.exe	101
PID 1928 wrote to memory of 3872	1928	cmd.exe	101
PID 1928 wrote to memory of 3872	1928	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\c3906e8ec3001cbfa355e83026573843.exe
"C:\Users\Admin\AppData\Local\Temp\c3906e8ec3001cbfa355e83026573843.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:3760
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4088
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:5008
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
4904209ea87f72004244f9d8675c0aa7

SHA1
9d738f9eb820d1ab2d7bd4528e9f2b91e042e32b

SHA256
d9f16d9a30b5f5097d0fb9d522258ec0fac2ba8f081f03eeb7373a512f3de179

SHA512
a92ce1b3c137a61f9a43bbd88ee1f21b0655755483dc125194f6a5858f3ff66aa7e631f8f8fdcd0d60fa32dadfc1159737990edb9e777f9ac89dea4e72dbcf1a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads