8ae976c8b28baa222b4fd527cccbad2d1102ed21c68f9082c53835fde94c2397

Analysis

max time kernel
153s
max time network
132s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Payload/Hot Tub.app/Firebase_FirebaseCoreExtension.bundle/Info.plist
Size

715B
MD5

fe24c35d944a211114ec155e1b03df3b
SHA1

9b80d4698660c192cc98dfc7cd05051240d59a25
SHA256

d8c3df28e5f49659b72ecd4de57da4e9f7aae77e07acc4337f9e50f7f1e284e0
SHA512

a13315d5cf25a3c7d1007f0bd1d4f18b51bc15780c1a821ec85bb100be44ef62bff2f59a8495531e771cceb3e3b72b1b009b6ff591083f2e62cc063026e4e887

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2464	2044	cmd.exe	31
PID 2044 wrote to memory of 2464	2044	cmd.exe	31
PID 2044 wrote to memory of 2464	2044	cmd.exe	31
PID 2464 wrote to memory of 2784	2464	rundll32.exe	33
PID 2464 wrote to memory of 2784	2464	rundll32.exe	33
PID 2464 wrote to memory of 2784	2464	rundll32.exe	33
PID 2464 wrote to memory of 2784	2464	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Payload\Hot Tub.app\Firebase_FirebaseCoreExtension.bundle\Info.plist"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Payload\Hot Tub.app\Firebase_FirebaseCoreExtension.bundle\Info.plist
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Payload\Hot Tub.app\Firebase_FirebaseCoreExtension.bundle\Info.plist"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e7ae190550005c6b610ac94161158e30

SHA1
d9a289ce0043ad8eb50adf0b5b97710d0bd7988d

SHA256
eaffc8765f4a1375428cceffd591b77659f258772f620665eab96f7f016374f4

SHA512
568436d70583b05ca445c4139de23c3b2e82136aed784878abe241845a168f698502d5cc661540a65dfb02e3763a275821f7025877cb0d07417339b4f992526e

Download Submit