c5fa821a4462e0a3dedd070bb38e0ea1ac927541ca62df33fe91519bb5d84866

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bartender 5 5.0.27/.VolumeIcon.icns:com.apple.macl
Size

72B
MD5

06255dbc70d5aec1bc9d06fe14789a9d
SHA1

985052dc8b9fd8c95535b1579402c20b23e1ca53
SHA256

bf87935551fe79b8d6161ff5f7132ff1899883f75b0fce5d64ffe9b4715a2c67
SHA512

1107481fe3ffc792540fb854b9dad9aee56b86a242ede045e0d0e87ef51ee0c92201570fba90b753ce2776372977e5d7c3f552527d67446f33f59137debb3f96

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\macl_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.macl	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\macl_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\macl_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.macl\ = "macl_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\macl_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\macl_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\macl_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2676	2696	cmd.exe	31
PID 2696 wrote to memory of 2676	2696	cmd.exe	31
PID 2696 wrote to memory of 2676	2696	cmd.exe	31
PID 2676 wrote to memory of 2600	2676	rundll32.exe	32
PID 2676 wrote to memory of 2600	2676	rundll32.exe	32
PID 2676 wrote to memory of 2600	2676	rundll32.exe	32
PID 2676 wrote to memory of 2600	2676	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\.VolumeIcon.icns_com.apple.macl"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\.VolumeIcon.icns_com.apple.macl
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Bartender 5 5.0.27\.VolumeIcon.icns_com.apple.macl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
059a48d24f9e43844e44e086048e31bf

SHA1
4f1c404862fbd7ce3d97f7b2aa1e8669c553b72f

SHA256
a6c52cdbf47519d2f1123d66144ad3e67624f9a81ff37a84c78f0374f3e096f7

SHA512
b2f16b5e27bf505a8891f7adf01313466443a985e8ca3827c8a92932828dd91cb338cbf6c2679aa7ead0eaa72e8bee5750107bd4d945efe550ed7433bedd9df7

Download Submit