c5fa821a4462e0a3dedd070bb38e0ea1ac927541ca62df33fe91519bb5d84866

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bartender 5 5.0.27/Help.txt:com.apple.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa
Size

89B
MD5

91d7387467af8025b34179eaec85926d
SHA1

c6cf933558aa7c77a79959cd7461d3d5c3d8ced6
SHA256

2a341555048df0a37df3227d9f3190c57751114f605e8c0456f0aa4672bdb829
SHA512

4554e1ff477d0ff2b243b38e07476b87a31656a96d621245504e4b6e8a22d7935a5858e0f7f85ce65f9a9724b6fd2b1a21a9b42798e217f105db1db05355fd6e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa\ = "metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2900	2964	cmd.exe	31
PID 2964 wrote to memory of 2900	2964	cmd.exe	31
PID 2964 wrote to memory of 2900	2964	cmd.exe	31
PID 2900 wrote to memory of 2752	2900	rundll32.exe	32
PID 2900 wrote to memory of 2752	2900	rundll32.exe	32
PID 2900 wrote to memory of 2752	2900	rundll32.exe	32
PID 2900 wrote to memory of 2752	2900	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\Help.txt_com.apple.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\Help.txt_com.apple.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\Help.txt_com.apple.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
15f3af03eae7e4b3f4b1819919415d1f

SHA1
af199ddb68e4de71998698c2ab1edc7c3c2a1e6d

SHA256
d1d45179eff6894baac3551314cb0948bac407d7172386c0fc46aae7ed6a6e89

SHA512
98f9185bbfd907b17fcd55d42e303590e516c247f50cb5fafd242f1b0f7bde3bd6959051914185598808ca075be69e34fd2345b217ab8dd2cce3dfc3e6296c6c

Download Submit