63c442616fcc7c22f82f211814a7d4aaff5f33859713ff84fa83e14d74af3c86

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e24c08fc9e089aeda2c3cb45f1e678bc.exe
Size

24KB
MD5

e24c08fc9e089aeda2c3cb45f1e678bc
SHA1

d2bef36216060bbd23d69aeda29848e9fa8454c6
SHA256

63c442616fcc7c22f82f211814a7d4aaff5f33859713ff84fa83e14d74af3c86
SHA512

3ed55be083d6b0ccf5851fef25f2f37f236cf2b5a7665d4bcd4408f9ddfae8918e1e99d3abbba1f586e0a2217f91cb117c5e2f8dad45ece3964c6b8f208e030d
SSDEEP

384:E3eVES+/xwGkRKJklM61qmTTMVF9/q5f0:bGS+ZfbJkO8qYoAc

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Start GeekBuddy = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\spoolsv.exe"	e24c08fc9e089aeda2c3cb45f1e678bc.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\spoolsv.exe	e24c08fc9e089aeda2c3cb45f1e678bc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2200	tasklist.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4252	ipconfig.exe
3648	NETSTAT.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	tasklist.exe
Token: SeDebugPrivilege	3648	NETSTAT.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2152	e24c08fc9e089aeda2c3cb45f1e678bc.exe
2152	e24c08fc9e089aeda2c3cb45f1e678bc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2700	2152	e24c08fc9e089aeda2c3cb45f1e678bc.exe	85
PID 2152 wrote to memory of 2700	2152	e24c08fc9e089aeda2c3cb45f1e678bc.exe	85
PID 2152 wrote to memory of 2700	2152	e24c08fc9e089aeda2c3cb45f1e678bc.exe	85
PID 2700 wrote to memory of 4976	2700	cmd.exe	87
PID 2700 wrote to memory of 4976	2700	cmd.exe	87
PID 2700 wrote to memory of 4976	2700	cmd.exe	87
PID 2700 wrote to memory of 4252	2700	cmd.exe	88
PID 2700 wrote to memory of 4252	2700	cmd.exe	88
PID 2700 wrote to memory of 4252	2700	cmd.exe	88
PID 2700 wrote to memory of 2200	2700	cmd.exe	89
PID 2700 wrote to memory of 2200	2700	cmd.exe	89
PID 2700 wrote to memory of 2200	2700	cmd.exe	89
PID 2700 wrote to memory of 2144	2700	cmd.exe	93
PID 2700 wrote to memory of 2144	2700	cmd.exe	93
PID 2700 wrote to memory of 2144	2700	cmd.exe	93
PID 2144 wrote to memory of 3980	2144	net.exe	94
PID 2144 wrote to memory of 3980	2144	net.exe	94
PID 2144 wrote to memory of 3980	2144	net.exe	94
PID 2700 wrote to memory of 3648	2700	cmd.exe	95
PID 2700 wrote to memory of 3648	2700	cmd.exe	95
PID 2700 wrote to memory of 3648	2700	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\e24c08fc9e089aeda2c3cb45f1e678bc.exe
"C:\Users\Admin\AppData\Local\Temp\e24c08fc9e089aeda2c3cb45f1e678bc.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4252
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\SysWOW64\net.exe
    net start
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      4⤵
      PID:3980
- - C:\Windows\SysWOW64\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\temp\flash.log

Filesize
14KB

MD5
eba7e00b7286df8569b2c5361e41dc7f

SHA1
6e9ad81a6e591dacbff01468c17f803202cd8bb8

SHA256
3a41597ac694a26817d0328c91cebb3593ede289555f8b1e16e9c43809781af1

SHA512
ae8b7e2ec59cfd90a5fa8d580bcd4800064d2a7dcbe4e2b8c020297cab5598f873c1c797571bfc5d0a73d348232e019f58f2020bd511bc68f7cfa96ff6d6a97f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads