39eed41a282105d827a5ed1c6bd0e50e5b69d8535f80c2e67aeb2f0da72e1628

Resubmissions

15/10/2024, 23:54

241015-3x4fvsxemq 8

15/10/2024, 23:51

241015-3v719sxdrl 7

Analysis

max time kernel
141s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload/Mabz.app/PhoneNumberKit_PhoneNumberKit.bundle/PhoneNumberMetadata.json
Size

351KB
MD5

b0888ca83d9bd45aa19e49f9015c76a5
SHA1

562513b95dda5b5222202f1d56a89c3950cdaa59
SHA256

3d47e215206d79a787fe95baa2481f7ef0d765cbb9ea007635ae20ee9f9b5cb2
SHA512

070a4b40d53db4b016fdcf415371e278e6b7ab7614072f44cad1b92c1e938b47e94c617e5500206b6b20b5328950104be4dffb01de6a407438e51989fd6448c3
SSDEEP

3072:NULFPFjpXpcFrFHSFljL03d4PS8yAopmFPTswfNR2F6FkpbF0F6hF/eMTFNplbLk:05zCy9MFK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5116	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\PhoneNumberKit_PhoneNumberKit.bundle\PhoneNumberMetadata.json
1⤵
- Modifies registry class
PID:1164

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads