2f55a94ef7bf5b378385a3d478b3b6fce3447b134ff58f741bc0d5e13dafadce

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de319c18f8e26764fe10a5eb80f7e602.exe
Size

24KB
MD5

de319c18f8e26764fe10a5eb80f7e602
SHA1

cc0e7693ebf09e0b5099e3d9e17444fbc45a2541
SHA256

2f55a94ef7bf5b378385a3d478b3b6fce3447b134ff58f741bc0d5e13dafadce
SHA512

9b232ff028a5d3d4e6ad3933646ae5b73f4e2b085fe3920fce1d775fbb9627e287f4d280333ab31fe0a3f0b212bae1b3f52497376f830d58a27cdd7aa61bef86
SSDEEP

384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5k0:bGS+ZfbJiO8qYoAF

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	de319c18f8e26764fe10a5eb80f7e602.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	de319c18f8e26764fe10a5eb80f7e602.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4756	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2184	ipconfig.exe
1700	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	tasklist.exe
Token: SeDebugPrivilege	1700	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3124	de319c18f8e26764fe10a5eb80f7e602.exe
3124	de319c18f8e26764fe10a5eb80f7e602.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 1648	3124	de319c18f8e26764fe10a5eb80f7e602.exe	93
PID 3124 wrote to memory of 1648	3124	de319c18f8e26764fe10a5eb80f7e602.exe	93
PID 3124 wrote to memory of 1648	3124	de319c18f8e26764fe10a5eb80f7e602.exe	93
PID 1648 wrote to memory of 3144	1648	cmd.exe	96
PID 1648 wrote to memory of 3144	1648	cmd.exe	96
PID 1648 wrote to memory of 3144	1648	cmd.exe	96
PID 1648 wrote to memory of 2184	1648	cmd.exe	97
PID 1648 wrote to memory of 2184	1648	cmd.exe	97
PID 1648 wrote to memory of 2184	1648	cmd.exe	97
PID 1648 wrote to memory of 4756	1648	cmd.exe	99
PID 1648 wrote to memory of 4756	1648	cmd.exe	99
PID 1648 wrote to memory of 4756	1648	cmd.exe	99
PID 1648 wrote to memory of 1788	1648	cmd.exe	102
PID 1648 wrote to memory of 1788	1648	cmd.exe	102
PID 1648 wrote to memory of 1788	1648	cmd.exe	102
PID 1788 wrote to memory of 1896	1788	net.exe	103
PID 1788 wrote to memory of 1896	1788	net.exe	103
PID 1788 wrote to memory of 1896	1788	net.exe	103
PID 1648 wrote to memory of 1700	1648	cmd.exe	104
PID 1648 wrote to memory of 1700	1648	cmd.exe	104
PID 1648 wrote to memory of 1700	1648	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\de319c18f8e26764fe10a5eb80f7e602.exe
"C:\Users\Admin\AppData\Local\Temp\de319c18f8e26764fe10a5eb80f7e602.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:3144
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2184
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:1896
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1780 --field-trial-handle=2000,i,9877262470271371196,11878025205711850266,262144 --variations-seed-version /prefetch:8
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
1bbfe40badd3d8d34a397fac4b97e058

SHA1
87281d7c106cc462efd6367acfd1b1bea98a1aa9

SHA256
c1e7539e49a254d744008027c5083d6fea91b0998977639978d0e134bafbaaa2

SHA512
5c613f05d3bfed6aefbf4c679097908146416f7bcf46cf7400e1e78a11ec7a7809164e59cfd88a479a0ca236691e35f8daf2f900acd9a55bc4faf378305d4ead

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads