fa6ef21abbecee8a4518ab0c4a06918e12cdf656ac17bce02fb2e0efc8affe9b

Analysis

max time kernel
217s
max time network
217s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11/02/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

jhgw.py
Size

8KB
MD5

25656285e953e9a0d47f74e35b04cdc5
SHA1

8479a801987b0a837ad12ade4b96346857bcfc63
SHA256

fa6ef21abbecee8a4518ab0c4a06918e12cdf656ac17bce02fb2e0efc8affe9b
SHA512

cb002e7cc4410d76664d12c84d5d9e0cca3d20b595f2b9c14c5478f47256d035489df6d198aa77ee1b14d88b34f598d41f1b5fc5d052bcd4abde1962b6f87beb
SSDEEP

192:Z3JDdIFVpRN+9CNB7hrWibDkndjgsYFRo7sL:Z+zb+0jNhkndjgsYFRH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	904	AUDIODG.EXE
Token: 33	904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	904	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2600	2468	cmd.exe	29
PID 2468 wrote to memory of 2600	2468	cmd.exe	29
PID 2468 wrote to memory of 2600	2468	cmd.exe	29
PID 2600 wrote to memory of 2644	2600	rundll32.exe	30
PID 2600 wrote to memory of 2644	2600	rundll32.exe	30
PID 2600 wrote to memory of 2644	2600	rundll32.exe	30
PID 2600 wrote to memory of 2644	2600	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\jhgw.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\jhgw.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\jhgw.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2644

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1744

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x440
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2dfc785b99e85eca17e08daacd4309d9

SHA1
fef824b363b6f2ca18b2a7869bf5533ff58684af

SHA256
05bb10d28a41cf7055c31a9b81d1e12e83c899bf337b90856f531f57bd25aa06

SHA512
a56317ac98b2ef7b6341417a5c55aa3ca32cebd16f827a3c2447c1f3d1e843b26c51e396b086767a15042fa1df12dc3ab164af228330e714bd8fa9a09e05f6fd

Download Submit
memory/1708-51-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1744-41-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download