25fdecb69dd938a96173f5d2f9e10308ee21fc090ac64f8df713e10e5715f7cb

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c73aa859f981218abdec40e6984e33d7.exe
Size

24KB
MD5

c73aa859f981218abdec40e6984e33d7
SHA1

56194e99c395eb8566fb26435be6c1f3ee8c5b4d
SHA256

25fdecb69dd938a96173f5d2f9e10308ee21fc090ac64f8df713e10e5715f7cb
SHA512

83d4fb3b7108912856b41745fec956f73f6aae316d96fa82fb4179522940597832f2e202c8266b558e8ad7e5db30e42fba6d0b78ecc85456313f53dd1c1ddba7
SSDEEP

384:E3eVES+/xwGkRKJXlM61qmTTMVF9/q54v0:bGS+ZfbJXO8qYoA7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	c73aa859f981218abdec40e6984e33d7.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	c73aa859f981218abdec40e6984e33d7.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4444	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1456	ipconfig.exe
632	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	tasklist.exe
Token: SeDebugPrivilege	632	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2528	c73aa859f981218abdec40e6984e33d7.exe
2528	c73aa859f981218abdec40e6984e33d7.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 4548	2528	c73aa859f981218abdec40e6984e33d7.exe	89
PID 2528 wrote to memory of 4548	2528	c73aa859f981218abdec40e6984e33d7.exe	89
PID 2528 wrote to memory of 4548	2528	c73aa859f981218abdec40e6984e33d7.exe	89
PID 4548 wrote to memory of 2516	4548	cmd.exe	92
PID 4548 wrote to memory of 2516	4548	cmd.exe	92
PID 4548 wrote to memory of 2516	4548	cmd.exe	92
PID 4548 wrote to memory of 1456	4548	cmd.exe	93
PID 4548 wrote to memory of 1456	4548	cmd.exe	93
PID 4548 wrote to memory of 1456	4548	cmd.exe	93
PID 4548 wrote to memory of 4444	4548	cmd.exe	94
PID 4548 wrote to memory of 4444	4548	cmd.exe	94
PID 4548 wrote to memory of 4444	4548	cmd.exe	94
PID 4548 wrote to memory of 2756	4548	cmd.exe	96
PID 4548 wrote to memory of 2756	4548	cmd.exe	96
PID 4548 wrote to memory of 2756	4548	cmd.exe	96
PID 2756 wrote to memory of 4824	2756	net.exe	97
PID 2756 wrote to memory of 4824	2756	net.exe	97
PID 2756 wrote to memory of 4824	2756	net.exe	97
PID 4548 wrote to memory of 632	4548	cmd.exe	98
PID 4548 wrote to memory of 632	4548	cmd.exe	98
PID 4548 wrote to memory of 632	4548	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\c73aa859f981218abdec40e6984e33d7.exe
"C:\Users\Admin\AppData\Local\Temp\c73aa859f981218abdec40e6984e33d7.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1456
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:4824
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
15KB

MD5
408a7e7840c203bec7a0839650525e03

SHA1
52ecf79b58760ff6a88b036b799426c8d1986d0c

SHA256
74ab0f730d30236ee18543a08847a857e5515bfd2658c338ab4eb826c12c4e7f

SHA512
3996315588f9f6db7ebdee8b4736c45cb31f4c8a3a50143c8c01ba6e2d986c25392f8d7b9ee7cac71ddfe35e7ac84d017cae32556664b2e11263cda83a416b5e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads