c5fa821a4462e0a3dedd070bb38e0ea1ac927541ca62df33fe91519bb5d84866

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bartender 5 5.0.27/.background/bg.png:com.apple.macl
Size

72B
MD5

aff632836c1164c3992766c106b57f8d
SHA1

304c76f5622207b015bd917088978bb010db73a5
SHA256

b51d79f2cfffaf62a5cd2bc33ffecbb8c007d03b8e705222d283525e88eb77b5
SHA512

d6e0c235a5a1fd4c7304dfc7fd0b3ce138b00a6731f9e71bfd046034ca32708a2a3e0621d0dd4c3c23702841abebc7403275deea01409a68a5265edf803bd93e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\macl_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.macl\ = "macl_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\macl_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\macl_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\macl_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\macl_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\macl_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.macl	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2908	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2908	AcroRd32.exe
2908	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2124	2556	cmd.exe	32
PID 2556 wrote to memory of 2124	2556	cmd.exe	32
PID 2556 wrote to memory of 2124	2556	cmd.exe	32
PID 2124 wrote to memory of 2908	2124	rundll32.exe	33
PID 2124 wrote to memory of 2908	2124	rundll32.exe	33
PID 2124 wrote to memory of 2908	2124	rundll32.exe	33
PID 2124 wrote to memory of 2908	2124	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\.background\bg.png_com.apple.macl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\.background\bg.png_com.apple.macl
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\.background\bg.png_com.apple.macl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
26024acc495d2a1e2e7f4e1120b4bf89

SHA1
05cfb83f8c1a05da580f28baa385c2618d3f67ef

SHA256
2f3eed3696db133e20e18915a2c87f1a5445dbc24deebd8fbffb1eca2629a4a6

SHA512
4c4fb2a59651de2a64218aeb3f08495b37c0e98276d162c4043b81f046c934f413deb351047519fc9877ad01b3c29e4597e245cb7e6236e8a7f5c3c4bfa5dfba

Download Submit