144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
02/02/2025, 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LenovoSafeBox455.apk
Size

927KB
MD5

02297e27886d758b1f6892b5047ff9ff
SHA1

bf03f835c42a8734d9d862741a235ea3491036ea
SHA256

e0a9bdf5dc4481d913038e6509635b12d12016e820ecc58a5971be3bb72dcb2b
SHA512

d9784281450f91cc32b4feadc0dbf8d76b10bbcf35e7dcd362bc940103317b4e8fafba9fa9dbe0b954d20478d700b92df4f661f53edc6022d67f3bcd85276c8d
SSDEEP

24576:wtMiI2b4apsiko9W8C/2htK3JdFgdXlQ53RJ3J:5iD5pUoW8e0tqVgdXGhJ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2764	2844	cmd.exe	31
PID 2844 wrote to memory of 2764	2844	cmd.exe	31
PID 2844 wrote to memory of 2764	2844	cmd.exe	31
PID 2764 wrote to memory of 2700	2764	rundll32.exe	32
PID 2764 wrote to memory of 2700	2764	rundll32.exe	32
PID 2764 wrote to memory of 2700	2764	rundll32.exe	32
PID 2764 wrote to memory of 2700	2764	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LenovoSafeBox455.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\LenovoSafeBox455.apk
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LenovoSafeBox455.apk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
438ac71b762be1be50c9c7b25339df57

SHA1
a8a25318b5e7016d1f93ca5d7542dd0674fa51c7

SHA256
e23ada5d111abb1f8f7cb5aa3fdc7d005799f4f66c98bbdacaab58cd4b7ef860

SHA512
b77d3693fd59787c7a1bb2d6502ec87047a177a7759da88c94eeff8c16cf2d4e7325a20b7b4c1ce16274c81486b4d92efa007423227c5955b736e6bb67dc99dc

Download Submit