fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/03/2025, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NullsBrawlOFFICIALNOVIRUS100%LEGIT.apk
Size

533KB
MD5

9f01767647e2e72f446d374bbcb20c53
SHA1

f6b1adcd7723b525418a05bcede5c671366d7ab3
SHA256

fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
SHA512

4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
SSDEEP

12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2068	3000	cmd.exe	31
PID 3000 wrote to memory of 2068	3000	cmd.exe	31
PID 3000 wrote to memory of 2068	3000	cmd.exe	31
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32
PID 2068 wrote to memory of 2440	2068	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NullsBrawlOFFICIALNOVIRUS100%LEGIT.apk
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\NullsBrawlOFFICIALNOVIRUS100%LEGIT.apk
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NullsBrawlOFFICIALNOVIRUS100%LEGIT.apk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
726a56bd26fcb760435bce59fa86d1f9

SHA1
1c4c4028a6046f205cc00a39acaeed6e4f788051

SHA256
029e0f5893caa1453ee00f2991dd2c1b4372a076be49ab2151a395551a965720

SHA512
86f7d3bfd58f8fee69ebbab9209fb783d0124f4c8ea00822359f9f3f1646cf5758343992e8605fbb31919b2b4a1f0d2c0029c36f6ca57d7108b9e0a51a624cdb

Download Submit