4656eed80192235c9318dc8bc6133696fd50ffe4fc7144b4aafbf21f15b41936

General

Target
df313fff3a554e9ad5c2ade4854960cd.exe
Size 24KB
Sample240326-pye8rsae33
SHA256 4656eed80192235c9318dc8bc6133696fd50ffe4fc7144b4aafbf21f15b41936
MD5 df313fff3a554e9ad5c2ade4854960cd
SHA1 91e77a96d0341e63c79e1a8e0513695157145410
SHA512 b23be0857930d4a05db5a0bf6baa6f4ed4381757af00f07b84fd52ad697f928bf03e3ddc1f9f0dad4fce094949014dbed67a99b9c6643d2704336f771bf3785a
SSDEEP 384:E3eVES+/xwGkRKJ5plM61qmTTMVF9/q5o0:bGS+ZfbJ5pO8qYoAR
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	df313fff3a554e9ad5c2ade4854960cd.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	df313fff3a554e9ad5c2ade4854960cd.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
5004	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3584	ipconfig.exe
2208	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	tasklist.exe
Token: SeDebugPrivilege	2208	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3788	df313fff3a554e9ad5c2ade4854960cd.exe
3788	df313fff3a554e9ad5c2ade4854960cd.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4404	3788	df313fff3a554e9ad5c2ade4854960cd.exe	95
PID 3788 wrote to memory of 4404	3788	df313fff3a554e9ad5c2ade4854960cd.exe	95
PID 3788 wrote to memory of 4404	3788	df313fff3a554e9ad5c2ade4854960cd.exe	95
PID 4404 wrote to memory of 2192	4404	cmd.exe	98
PID 4404 wrote to memory of 2192	4404	cmd.exe	98
PID 4404 wrote to memory of 2192	4404	cmd.exe	98
PID 4404 wrote to memory of 3584	4404	cmd.exe	99
PID 4404 wrote to memory of 3584	4404	cmd.exe	99
PID 4404 wrote to memory of 3584	4404	cmd.exe	99
PID 4404 wrote to memory of 5004	4404	cmd.exe	101
PID 4404 wrote to memory of 5004	4404	cmd.exe	101
PID 4404 wrote to memory of 5004	4404	cmd.exe	101
PID 4404 wrote to memory of 3432	4404	cmd.exe	103
PID 4404 wrote to memory of 3432	4404	cmd.exe	103
PID 4404 wrote to memory of 3432	4404	cmd.exe	103
PID 3432 wrote to memory of 3864	3432	net.exe	104
PID 3432 wrote to memory of 3864	3432	net.exe	104
PID 3432 wrote to memory of 3864	3432	net.exe	104
PID 4404 wrote to memory of 2208	4404	cmd.exe	105
PID 4404 wrote to memory of 2208	4404	cmd.exe	105
PID 4404 wrote to memory of 2208	4404	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\df313fff3a554e9ad5c2ade4854960cd.exe
"C:\Users\Admin\AppData\Local\Temp\df313fff3a554e9ad5c2ade4854960cd.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:3584
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:3864
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3020 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flash.log

Path \??\c:\windows\temp\flash.log
Size 15KB
SHA256 bc65aa6c87e33b0dec02074bb8df345a9821cea9d21a7c8522dbdcd410ecb89e
MD5 9a4ea7bd1b5c8d0eaa1b30e2724bc44c
SHA1 ec853a416bd45d0488b65241b84252d2232aa5db
SHA512 7ff17799e7caf1f1afcbac8461d6d784bafb76c46aa62cae097b2511e30efe0f4b5f9109f629ba1b161ecdb5aa941e99016f4f9ab40f3db46ec373e6d0a27763
SSDEEP 384:wm/wH+3hrDGWmt8BJKl7EyOf0324xDu+Y8Fy5uWUa75iJP1WMxd2W2l3y8h4x76q:roeRrDGWmt8BJKl7EyOf0324xDu+Y8Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads