c5fa821a4462e0a3dedd070bb38e0ea1ac927541ca62df33fe91519bb5d84866

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bartender 5 5.0.27/Help.txt:rsrc
Size

269KB
MD5

2dfe4fc75468c97dfa2516288e6959c2
SHA1

45b290ff6034d2fd299d5510f9c17bf962613bf1
SHA256

4de8692d088a30eecea856d70870dd475c30a462607c8f80bb9b41d6ffc70834
SHA512

794d897a2a05468c5244553a971bd0269bb08db58ffd2da3ee3ea99c52998677080b9f5991ac4535c10e892350eeed41c5f79c83d5f5f1982bfdffc873f2d85b
SSDEEP

6144:dpN5TSLG3NVtQW6kkkaJRiI34CidYmnoqyDY:HHTh3azNJz34sZqyDY

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.txt_rsrc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\.txt_rsrc\ = "txt_rsrc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\txt_rsrc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\txt_rsrc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\txt_rsrc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\txt_rsrc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\txt_rsrc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\txt_rsrc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 968	2960	cmd.exe	31
PID 2960 wrote to memory of 968	2960	cmd.exe	31
PID 2960 wrote to memory of 968	2960	cmd.exe	31
PID 968 wrote to memory of 2892	968	rundll32.exe	33
PID 968 wrote to memory of 2892	968	rundll32.exe	33
PID 968 wrote to memory of 2892	968	rundll32.exe	33
PID 968 wrote to memory of 2892	968	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\Help.txt_rsrc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\Help.txt_rsrc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\Help.txt_rsrc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e50e37cf8e10410c344ba8bd17c7f652

SHA1
aa363be9f4eb478c82b236efc5fb7434a5dc81ac

SHA256
ac42abac20547c62f50e639ee671548a62ed24e5509cf9ef75db08f28187819a

SHA512
262b020be9e92e06a434456d47d0782c6ff4a2ae72db7271a617318a81c4cb7a7e701ca2a26388a3e3a04c3b6ead284ccc629479e82463d4bec7ed1ec31e218a

Download Submit