Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 13:20 UTC
Static task
static1
Behavioral task
behavioral1
Sample
d39cd2526b63d2734e9a9549f9c4496c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d39cd2526b63d2734e9a9549f9c4496c.exe
Resource
win10v2004-20240226-en
General
-
Target
d39cd2526b63d2734e9a9549f9c4496c.exe
-
Size
24KB
-
MD5
d39cd2526b63d2734e9a9549f9c4496c
-
SHA1
f020870fbd682e4742ceea6267d4161291b878ec
-
SHA256
a602959e83994fac4374a6b3170fffe7f62b6b8b829575b0a300c9c991c77ff6
-
SHA512
adb6ec98c2a06d09d087be649ebde39b446847f0f8b45bade3e7914a95f1d3fb9d880dd0079c2fbe4e74629a345770c54c9fc771e396df3999b441a1eb7851c2
-
SSDEEP
384:E3eVES+/xwGkRKJilM61qmTTMVF9/q58n0:bGS+ZfbJiO8qYoAf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe" d39cd2526b63d2734e9a9549f9c4496c.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe d39cd2526b63d2734e9a9549f9c4496c.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4244 tasklist.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4884 ipconfig.exe 1408 NETSTAT.EXE -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4244 tasklist.exe Token: SeDebugPrivilege 1408 NETSTAT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3916 d39cd2526b63d2734e9a9549f9c4496c.exe 3916 d39cd2526b63d2734e9a9549f9c4496c.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3916 wrote to memory of 2304 3916 d39cd2526b63d2734e9a9549f9c4496c.exe 88 PID 3916 wrote to memory of 2304 3916 d39cd2526b63d2734e9a9549f9c4496c.exe 88 PID 3916 wrote to memory of 2304 3916 d39cd2526b63d2734e9a9549f9c4496c.exe 88 PID 2304 wrote to memory of 5044 2304 cmd.exe 90 PID 2304 wrote to memory of 5044 2304 cmd.exe 90 PID 2304 wrote to memory of 5044 2304 cmd.exe 90 PID 2304 wrote to memory of 4884 2304 cmd.exe 91 PID 2304 wrote to memory of 4884 2304 cmd.exe 91 PID 2304 wrote to memory of 4884 2304 cmd.exe 91 PID 2304 wrote to memory of 4244 2304 cmd.exe 92 PID 2304 wrote to memory of 4244 2304 cmd.exe 92 PID 2304 wrote to memory of 4244 2304 cmd.exe 92 PID 2304 wrote to memory of 4404 2304 cmd.exe 94 PID 2304 wrote to memory of 4404 2304 cmd.exe 94 PID 2304 wrote to memory of 4404 2304 cmd.exe 94 PID 4404 wrote to memory of 1660 4404 net.exe 95 PID 4404 wrote to memory of 1660 4404 net.exe 95 PID 4404 wrote to memory of 1660 4404 net.exe 95 PID 2304 wrote to memory of 1408 2304 cmd.exe 97 PID 2304 wrote to memory of 1408 2304 cmd.exe 97 PID 2304 wrote to memory of 1408 2304 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\d39cd2526b63d2734e9a9549f9c4496c.exe"C:\Users\Admin\AppData\Local\Temp\d39cd2526b63d2734e9a9549f9c4496c.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\cmd.execmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log2⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.execmd /c set3⤵PID:5044
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4884
-
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\SysWOW64\net.exenet start3⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start4⤵PID:1660
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:1408
-
-
Network
-
Remote address:8.8.8.8:53Request43.56.20.217.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestwww.kvic.jpIN AResponse
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.160.77.104.in-addr.arpaIN PTRResponse23.160.77.104.in-addr.arpaIN PTRa104-77-160-23deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 78844
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6A9CA579411B460FAD0797E22CF96FF8 Ref B: LON04EDGE0716 Ref C: 2024-03-18T13:21:40Z
date: Mon, 18 Mar 2024 13:21:39 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388212_1DTNU2NAFQGIU7JBO&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239339388212_1DTNU2NAFQGIU7JBO&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 184873
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6C6F921F2F4241DAA96220DC39C3311F Ref B: LON04EDGE0716 Ref C: 2024-03-18T13:21:40Z
date: Mon, 18 Mar 2024 13:21:39 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301326_1QB4ZF0E8SX9X04IJ&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301326_1QB4ZF0E8SX9X04IJ&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 340273
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7D532793F61B42799EFF9F0A33CF305E Ref B: LON04EDGE0716 Ref C: 2024-03-18T13:21:40Z
date: Mon, 18 Mar 2024 13:21:39 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301735_1VV7XOGBHKSUM08SO&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301735_1VV7XOGBHKSUM08SO&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 152265
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A1B0A08FBF0C4EC1986AAD8EB317255C Ref B: LON04EDGE0716 Ref C: 2024-03-18T13:21:40Z
date: Mon, 18 Mar 2024 13:21:39 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 322167
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1E1BCAAAFC57450F884DBF61879D97CC Ref B: LON04EDGE0716 Ref C: 2024-03-18T13:21:40Z
date: Mon, 18 Mar 2024 13:21:39 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388213_1WCQ3PJBBE0FIXEBL&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239339388213_1WCQ3PJBBE0FIXEBL&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 89146
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 14DBF4F2D6794BF9B0B86BAF924766A2 Ref B: LON04EDGE0716 Ref C: 2024-03-18T13:21:40Z
date: Mon, 18 Mar 2024 13:21:39 GMT
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request12.173.189.20.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239339388213_1WCQ3PJBBE0FIXEBL&pid=21.2&w=1080&h=1920&c=4tls, http244.1kB 1.2MB 899 895
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388212_1DTNU2NAFQGIU7JBO&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301326_1QB4ZF0E8SX9X04IJ&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301735_1VV7XOGBHKSUM08SO&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388213_1WCQ3PJBBE0FIXEBL&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200 -
1.2kB 8.1kB 16 14
-
1.2kB 8.1kB 16 14
-
1.2kB 8.1kB 16 14
-
1.3kB 8.5kB 17 14
-
71 B 131 B 1 1
DNS Request
43.56.20.217.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
57 B 107 B 1 1
DNS Request
www.kvic.jp
-
72 B 158 B 1 1
DNS Request
241.154.82.20.in-addr.arpa
-
142 B 157 B 2 1
DNS Request
26.35.223.20.in-addr.arpa
DNS Request
26.35.223.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
23.160.77.104.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
72 B 158 B 1 1
DNS Request
30.243.111.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
12.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5ad935c3772f8401e2893626d27bc5131
SHA160c4a9864ed753c37f1016c13f2d974959973844
SHA2562135339dccc98e4c78db7c59226b1ae76d4ad868c683064fcd58ebe606add8e9
SHA5122c3f5365a7571f9f27af6f71778c8dd6bfbd33d2e6cfe47a6a634321b59f4fdea387012198393f868c1789f0f81637aefb9d5868bc41de6187ceb4ba9f6130f9