Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
d39cd2526b63d2734e9a9549f9c4496c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d39cd2526b63d2734e9a9549f9c4496c.exe
Resource
win10v2004-20240226-en
General
-
Target
d39cd2526b63d2734e9a9549f9c4496c.exe
-
Size
24KB
-
MD5
d39cd2526b63d2734e9a9549f9c4496c
-
SHA1
f020870fbd682e4742ceea6267d4161291b878ec
-
SHA256
a602959e83994fac4374a6b3170fffe7f62b6b8b829575b0a300c9c991c77ff6
-
SHA512
adb6ec98c2a06d09d087be649ebde39b446847f0f8b45bade3e7914a95f1d3fb9d880dd0079c2fbe4e74629a345770c54c9fc771e396df3999b441a1eb7851c2
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q58n0:bGS+ZfbJiO8qYoAf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" d39cd2526b63d2734e9a9549f9c4496c.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe d39cd2526b63d2734e9a9549f9c4496c.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2964 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2700 ipconfig.exe 2648 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2964 tasklist.exe Token: SeDebugPrivilege 2648 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2884 d39cd2526b63d2734e9a9549f9c4496c.exe 2884 d39cd2526b63d2734e9a9549f9c4496c.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2172 2884 d39cd2526b63d2734e9a9549f9c4496c.exe 28 PID 2884 wrote to memory of 2172 2884 d39cd2526b63d2734e9a9549f9c4496c.exe 28 PID 2884 wrote to memory of 2172 2884 d39cd2526b63d2734e9a9549f9c4496c.exe 28 PID 2884 wrote to memory of 2172 2884 d39cd2526b63d2734e9a9549f9c4496c.exe 28 PID 2172 wrote to memory of 1720 2172 cmd.exe 30 PID 2172 wrote to memory of 1720 2172 cmd.exe 30 PID 2172 wrote to memory of 1720 2172 cmd.exe 30 PID 2172 wrote to memory of 1720 2172 cmd.exe 30 PID 2172 wrote to memory of 2700 2172 cmd.exe 31 PID 2172 wrote to memory of 2700 2172 cmd.exe 31 PID 2172 wrote to memory of 2700 2172 cmd.exe 31 PID 2172 wrote to memory of 2700 2172 cmd.exe 31 PID 2172 wrote to memory of 2964 2172 cmd.exe 32 PID 2172 wrote to memory of 2964 2172 cmd.exe 32 PID 2172 wrote to memory of 2964 2172 cmd.exe 32 PID 2172 wrote to memory of 2964 2172 cmd.exe 32 PID 2172 wrote to memory of 2584 2172 cmd.exe 34 PID 2172 wrote to memory of 2584 2172 cmd.exe 34 PID 2172 wrote to memory of 2584 2172 cmd.exe 34 PID 2172 wrote to memory of 2584 2172 cmd.exe 34 PID 2584 wrote to memory of 2600 2584 net.exe 35 PID 2584 wrote to memory of 2600 2584 net.exe 35 PID 2584 wrote to memory of 2600 2584 net.exe 35 PID 2584 wrote to memory of 2600 2584 net.exe 35 PID 2172 wrote to memory of 2648 2172 cmd.exe 36 PID 2172 wrote to memory of 2648 2172 cmd.exe 36 PID 2172 wrote to memory of 2648 2172 cmd.exe 36 PID 2172 wrote to memory of 2648 2172 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\d39cd2526b63d2734e9a9549f9c4496c.exe"C:\Users\Admin\AppData\Local\Temp\d39cd2526b63d2734e9a9549f9c4496c.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:1720
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2700
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2964
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:2600
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5732d659890ec122cbc85cbf4a3d603a1
SHA1c0805ae2dc9c532b1f3e29c74c1f9c01ea6a1fff
SHA256fc1f8a023e5d57ee8b3ea5f5b1830baa249f8da77fab3b49fcebde57be2b52f9
SHA5127b220ad1b187812ef1d96e2acf8d12e27cbe78e901ba516c5df747e3a935f5e5e644142f2c47fc4cde0e8bcb9fbfae46d5e255731807aae67e17495a821637b4