39eed41a282105d827a5ed1c6bd0e50e5b69d8535f80c2e67aeb2f0da72e1628

Resubmissions

15/10/2024, 23:54

241015-3x4fvsxemq 8

15/10/2024, 23:51

241015-3v719sxdrl 7

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload/Mabz.app/PlugIns/CAREx.appex/Info.plist
Size

962B
MD5

aff00cc21a529f1a2dcc53dded6ac4aa
SHA1

7d3c2fd4e42d79d2e8030044dad96ccfc83d9c71
SHA256

1a47efa41f61bf1061bc84523a1f169de320cb8490a52a7eacf5389e26fbf043
SHA512

cba35f14b31c3caca1974914ad8432a5df71b3c99d143e664089825b4e7d001c132c1804a56d3260beeed5bc536fdcbeaee68e9a67101c67f9a1cf484bfcb4c7

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	AcroRd32.exe
2240	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2176	1988	cmd.exe	29
PID 1988 wrote to memory of 2176	1988	cmd.exe	29
PID 1988 wrote to memory of 2176	1988	cmd.exe	29
PID 2176 wrote to memory of 2240	2176	rundll32.exe	30
PID 2176 wrote to memory of 2240	2176	rundll32.exe	30
PID 2176 wrote to memory of 2240	2176	rundll32.exe	30
PID 2176 wrote to memory of 2240	2176	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\PlugIns\CAREx.appex\Info.plist
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\PlugIns\CAREx.appex\Info.plist
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\PlugIns\CAREx.appex\Info.plist"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f63010c2f0276385202a1416c65868e0

SHA1
125df4a239e51c43a6759ab2156c6fa4c458c4d8

SHA256
3962a7f962ce8c3312a8d306f8af9c7abc169c0bf618932a96399af89c7e4c8d

SHA512
791b1083a7a2833405f34cbf5a1b8bbc2202919b938af78c38514bf6dd6386e4cbcbd7d0755c2ce0b26865e0897fc42bbdfeb7102f4e52e096564190e24a644a

Download Submit