Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
c921a19a803a3eb62ff67ecd9f5d238b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c921a19a803a3eb62ff67ecd9f5d238b.exe
Resource
win10v2004-20240226-en
General
-
Target
c921a19a803a3eb62ff67ecd9f5d238b.exe
-
Size
24KB
-
MD5
c921a19a803a3eb62ff67ecd9f5d238b
-
SHA1
8e48e538abf42a23ccb23714cf59593c41bbaaae
-
SHA256
d816fbf9bf26b466bc69a0cb1624c82bae397fe6f8ce6f388a330f70fe2d8150
-
SHA512
ce4b39da393c141e8fe890fd9c40f36c232684ee7000f106178e784ec04c382998e7fed76278a43f35d3fcb4fa679487b90ff4986cac188305c1bf7b40d6344f
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5N0:bGS+ZfbJiO8qYoAi
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" c921a19a803a3eb62ff67ecd9f5d238b.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe c921a19a803a3eb62ff67ecd9f5d238b.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2520 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2804 ipconfig.exe 2624 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2520 tasklist.exe Token: SeDebugPrivilege 2624 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2280 c921a19a803a3eb62ff67ecd9f5d238b.exe 2280 c921a19a803a3eb62ff67ecd9f5d238b.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1564 2280 c921a19a803a3eb62ff67ecd9f5d238b.exe 28 PID 2280 wrote to memory of 1564 2280 c921a19a803a3eb62ff67ecd9f5d238b.exe 28 PID 2280 wrote to memory of 1564 2280 c921a19a803a3eb62ff67ecd9f5d238b.exe 28 PID 2280 wrote to memory of 1564 2280 c921a19a803a3eb62ff67ecd9f5d238b.exe 28 PID 1564 wrote to memory of 2052 1564 cmd.exe 30 PID 1564 wrote to memory of 2052 1564 cmd.exe 30 PID 1564 wrote to memory of 2052 1564 cmd.exe 30 PID 1564 wrote to memory of 2052 1564 cmd.exe 30 PID 1564 wrote to memory of 2804 1564 cmd.exe 31 PID 1564 wrote to memory of 2804 1564 cmd.exe 31 PID 1564 wrote to memory of 2804 1564 cmd.exe 31 PID 1564 wrote to memory of 2804 1564 cmd.exe 31 PID 1564 wrote to memory of 2520 1564 cmd.exe 32 PID 1564 wrote to memory of 2520 1564 cmd.exe 32 PID 1564 wrote to memory of 2520 1564 cmd.exe 32 PID 1564 wrote to memory of 2520 1564 cmd.exe 32 PID 1564 wrote to memory of 2556 1564 cmd.exe 34 PID 1564 wrote to memory of 2556 1564 cmd.exe 34 PID 1564 wrote to memory of 2556 1564 cmd.exe 34 PID 1564 wrote to memory of 2556 1564 cmd.exe 34 PID 2556 wrote to memory of 2536 2556 net.exe 35 PID 2556 wrote to memory of 2536 2556 net.exe 35 PID 2556 wrote to memory of 2536 2556 net.exe 35 PID 2556 wrote to memory of 2536 2556 net.exe 35 PID 1564 wrote to memory of 2624 1564 cmd.exe 36 PID 1564 wrote to memory of 2624 1564 cmd.exe 36 PID 1564 wrote to memory of 2624 1564 cmd.exe 36 PID 1564 wrote to memory of 2624 1564 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\c921a19a803a3eb62ff67ecd9f5d238b.exe"C:\Users\Admin\AppData\Local\Temp\c921a19a803a3eb62ff67ecd9f5d238b.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:2052
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2804
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2536
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD56b70bb411b9171745463936c92c9d85f
SHA15f90ceda80abdb4d34e8a262c11869774f2d064f
SHA256d3d5feafe905f11a8b709e84dbd287a057d41159ac0721c05ea679a1f5b8b431
SHA5122d074f556a692b41f36d78d515ddaf2b385329aee908decb60948d62686ccd827218425e28d44016890e57771209462e7026178626c4223a1d003bcbfb267e77