Overview
overview
8Static
static
1Payload/Ma...32.png
windows7-x64
3Payload/Ma...32.png
windows10-2004-x64
3Payload/Ma...38.png
windows7-x64
3Payload/Ma...38.png
windows10-2004-x64
3Payload/Ma...48.png
windows7-x64
3Payload/Ma...48.png
windows10-2004-x64
3Payload/Ma...72.png
windows7-x64
3Payload/Ma...72.png
windows10-2004-x64
3Payload/Ma...t.json
windows7-x64
3Payload/Ma...t.json
windows10-2004-x64
3Payload/Ma...up.css
windows7-x64
3Payload/Ma...up.css
windows10-2004-x64
7Payload/Ma...es.xml
windows7-x64
3Payload/Ma...es.xml
windows10-2004-x64
1Payload/Ma...pi.cer
windows7-x64
8Payload/Ma...pi.cer
windows10-2004-x64
8Payload/Ma...ck.mp4
windows7-x64
1Payload/Ma...ck.mp4
windows10-2004-x64
6Payload/Ma.../c.wav
windows7-x64
1Payload/Ma.../c.wav
windows10-2004-x64
6Payload/Ma...er.cer
windows7-x64
8Payload/Ma...er.cer
windows10-2004-x64
8Payload/Ma...vision
windows7-x64
3Payload/Ma...vision
windows10-2004-x64
3Payload/Ma...eo.mov
windows7-x64
1Payload/Ma...eo.mov
windows10-2004-x64
6Payload/Ma...al.mp4
windows7-x64
1Payload/Ma...al.mp4
windows10-2004-x64
6Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-32.png
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-32.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-38.png
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-38.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-48.png
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-48.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-72.png
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/images/toolbar-icon-72.png
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/manifest.json
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/manifest.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/popup.css
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Payload/Mabz.app/PlugIns/CAREx.appex/popup.css
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Payload/Mabz.app/_CodeSignature/CodeResources.xml
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Payload/Mabz.app/_CodeSignature/CodeResources.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Payload/Mabz.app/api.cer
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Payload/Mabz.app/api.cer
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Payload/Mabz.app/back.mp4
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
Payload/Mabz.app/back.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Payload/Mabz.app/c.wav
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Payload/Mabz.app/c.wav
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Payload/Mabz.app/cer.cer
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Payload/Mabz.app/cer.cer
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Payload/Mabz.app/embedded.mobileprovision
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Payload/Mabz.app/embedded.mobileprovision
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Payload/Mabz.app/onVideo.mov
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Payload/Mabz.app/onVideo.mov
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Payload/Mabz.app/tutorial.mp4
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Payload/Mabz.app/tutorial.mp4
Resource
win10v2004-20241007-en
General
-
Target
Payload/Mabz.app/c.wav
-
Size
212KB
-
MD5
b8c0604cd7f46d8f9c8fd1afcd3e7e96
-
SHA1
abafdb5022578082234542383b8111ab6985b485
-
SHA256
3b06f7a05a673513e18612a6c39b5c93110459a75b4a4c8d66855224840ec4cd
-
SHA512
c7b5cf20a7ac2b0510ff2fb6c561c9bf9222b29c44b5534315e2bebe3b806c57f4701834804eeed900c14d3edc6db3dc1e0b1407749121c2154e636fe8090efd
-
SSDEEP
6144:4FUgpNiyW3QbLHUq2A43b2UFXvoZOyaesYX+:4FUwcy1/HUM45VoZDa/YX+
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2068 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2068 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2068 vlc.exe Token: SeIncBasePriorityPrivilege 2068 vlc.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
pid Process 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe -
Suspicious use of SendNotifyMessage 14 IoCs
pid Process 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe 2068 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2068 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Payload\Mabz.app\c.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2068