25fdecb69dd938a96173f5d2f9e10308ee21fc090ac64f8df713e10e5715f7cb

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c73aa859f981218abdec40e6984e33d7.exe
Size

24KB
MD5

c73aa859f981218abdec40e6984e33d7
SHA1

56194e99c395eb8566fb26435be6c1f3ee8c5b4d
SHA256

25fdecb69dd938a96173f5d2f9e10308ee21fc090ac64f8df713e10e5715f7cb
SHA512

83d4fb3b7108912856b41745fec956f73f6aae316d96fa82fb4179522940597832f2e202c8266b558e8ad7e5db30e42fba6d0b78ecc85456313f53dd1c1ddba7
SSDEEP

384:E3eVES+/xwGkRKJXlM61qmTTMVF9/q54v0:bGS+ZfbJXO8qYoA7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	c73aa859f981218abdec40e6984e33d7.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	c73aa859f981218abdec40e6984e33d7.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2824	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2536	ipconfig.exe
2464	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	tasklist.exe
Token: SeDebugPrivilege	2464	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2988	c73aa859f981218abdec40e6984e33d7.exe
2988	c73aa859f981218abdec40e6984e33d7.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2720	2988	c73aa859f981218abdec40e6984e33d7.exe	27
PID 2988 wrote to memory of 2720	2988	c73aa859f981218abdec40e6984e33d7.exe	27
PID 2988 wrote to memory of 2720	2988	c73aa859f981218abdec40e6984e33d7.exe	27
PID 2988 wrote to memory of 2720	2988	c73aa859f981218abdec40e6984e33d7.exe	27
PID 2720 wrote to memory of 2736	2720	cmd.exe	29
PID 2720 wrote to memory of 2736	2720	cmd.exe	29
PID 2720 wrote to memory of 2736	2720	cmd.exe	29
PID 2720 wrote to memory of 2736	2720	cmd.exe	29
PID 2720 wrote to memory of 2536	2720	cmd.exe	30
PID 2720 wrote to memory of 2536	2720	cmd.exe	30
PID 2720 wrote to memory of 2536	2720	cmd.exe	30
PID 2720 wrote to memory of 2536	2720	cmd.exe	30
PID 2720 wrote to memory of 2824	2720	cmd.exe	31
PID 2720 wrote to memory of 2824	2720	cmd.exe	31
PID 2720 wrote to memory of 2824	2720	cmd.exe	31
PID 2720 wrote to memory of 2824	2720	cmd.exe	31
PID 2720 wrote to memory of 2456	2720	cmd.exe	33
PID 2720 wrote to memory of 2456	2720	cmd.exe	33
PID 2720 wrote to memory of 2456	2720	cmd.exe	33
PID 2720 wrote to memory of 2456	2720	cmd.exe	33
PID 2456 wrote to memory of 2428	2456	net.exe	34
PID 2456 wrote to memory of 2428	2456	net.exe	34
PID 2456 wrote to memory of 2428	2456	net.exe	34
PID 2456 wrote to memory of 2428	2456	net.exe	34
PID 2720 wrote to memory of 2464	2720	cmd.exe	35
PID 2720 wrote to memory of 2464	2720	cmd.exe	35
PID 2720 wrote to memory of 2464	2720	cmd.exe	35
PID 2720 wrote to memory of 2464	2720	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\c73aa859f981218abdec40e6984e33d7.exe
"C:\Users\Admin\AppData\Local\Temp\c73aa859f981218abdec40e6984e33d7.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2536
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:2428
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
8KB

MD5
a786fea18720e8734278f128babf333e

SHA1
d9cdfee0a3d0c49d9af581328a966dece3fa1b67

SHA256
5350ea3c96e6932395f2f17a837eb14098534c3aa88ebf6e07a9c71ab60e3411

SHA512
3a867b0bbee9cdd5cd66dfea135d6720d5789aa5c0714385a6d62139d24b843bcf0e170352ecddfe422b2e47b79672f7bf9d01dc744f4350431165d6f5fb65c7

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads