Analysis
-
max time kernel
146s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 16:53
Static task
static1
Behavioral task
behavioral1
Sample
c921a19a803a3eb62ff67ecd9f5d238b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c921a19a803a3eb62ff67ecd9f5d238b.exe
Resource
win10v2004-20240226-en
General
-
Target
c921a19a803a3eb62ff67ecd9f5d238b.exe
-
Size
24KB
-
MD5
c921a19a803a3eb62ff67ecd9f5d238b
-
SHA1
8e48e538abf42a23ccb23714cf59593c41bbaaae
-
SHA256
d816fbf9bf26b466bc69a0cb1624c82bae397fe6f8ce6f388a330f70fe2d8150
-
SHA512
ce4b39da393c141e8fe890fd9c40f36c232684ee7000f106178e784ec04c382998e7fed76278a43f35d3fcb4fa679487b90ff4986cac188305c1bf7b40d6344f
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5N0:bGS+ZfbJiO8qYoAi
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" c921a19a803a3eb62ff67ecd9f5d238b.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe c921a19a803a3eb62ff67ecd9f5d238b.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 960 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 908 ipconfig.exe 840 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 960 tasklist.exe Token: SeDebugPrivilege 840 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 c921a19a803a3eb62ff67ecd9f5d238b.exe 4644 c921a19a803a3eb62ff67ecd9f5d238b.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1280 4644 c921a19a803a3eb62ff67ecd9f5d238b.exe 87 PID 4644 wrote to memory of 1280 4644 c921a19a803a3eb62ff67ecd9f5d238b.exe 87 PID 4644 wrote to memory of 1280 4644 c921a19a803a3eb62ff67ecd9f5d238b.exe 87 PID 1280 wrote to memory of 4364 1280 cmd.exe 89 PID 1280 wrote to memory of 4364 1280 cmd.exe 89 PID 1280 wrote to memory of 4364 1280 cmd.exe 89 PID 1280 wrote to memory of 908 1280 cmd.exe 90 PID 1280 wrote to memory of 908 1280 cmd.exe 90 PID 1280 wrote to memory of 908 1280 cmd.exe 90 PID 1280 wrote to memory of 960 1280 cmd.exe 91 PID 1280 wrote to memory of 960 1280 cmd.exe 91 PID 1280 wrote to memory of 960 1280 cmd.exe 91 PID 1280 wrote to memory of 1116 1280 cmd.exe 95 PID 1280 wrote to memory of 1116 1280 cmd.exe 95 PID 1280 wrote to memory of 1116 1280 cmd.exe 95 PID 1116 wrote to memory of 4668 1116 net.exe 96 PID 1116 wrote to memory of 4668 1116 net.exe 96 PID 1116 wrote to memory of 4668 1116 net.exe 96 PID 1280 wrote to memory of 840 1280 cmd.exe 97 PID 1280 wrote to memory of 840 1280 cmd.exe 97 PID 1280 wrote to memory of 840 1280 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\c921a19a803a3eb62ff67ecd9f5d238b.exe"C:\Users\Admin\AppData\Local\Temp\c921a19a803a3eb62ff67ecd9f5d238b.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:4364
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:908
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:4668
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:840
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5b1a67ef03eb778768408a7b825338b1f
SHA17d1ae8f0d76106cf6db74627edc930bee2502dea
SHA25605e8e04205d685287dd8e6141ba6c2c2f88fbc00c1533ae7f76fd1e573b52d46
SHA5129e38869ff4f8f9fdd6b64d84e1a1f929fa26bddcfe611e8d8800d87c1382cf46cf5298cbd374e3d5f6bb4f7a57b9e8fd48ef1e7d019c30ca81e86737f5c9e9a1