d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flexibel/Pygalgia/medlever.jad
Size

2KB
MD5

18260dbf7014af5adc94692ae0d4150c
SHA1

ca0b5023c70a3ba59c3892823453ff3c4b1ded2f
SHA256

119213bd3c56720d9544d46a09f4b699248c9a0b05a83912374e2ead70f9090b
SHA512

e22c39393db9e92ed89c8a55aa04ee1d1601872c24764a3c3483fa166ebac8a07061e76b25add27a87e84de1f6aa0aa454cf7808704bb7a49e7e1147b4987cb0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2196	2320	cmd.exe	29
PID 2320 wrote to memory of 2196	2320	cmd.exe	29
PID 2320 wrote to memory of 2196	2320	cmd.exe	29
PID 2196 wrote to memory of 2612	2196	rundll32.exe	30
PID 2196 wrote to memory of 2612	2196	rundll32.exe	30
PID 2196 wrote to memory of 2612	2196	rundll32.exe	30
PID 2196 wrote to memory of 2612	2196	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1b1cf727fbc9f697e249aa3b0f8edac

SHA1
ed5a113612ed5b4ee5bac5eef6b27d3271a89121

SHA256
0649f541fbe27e89b7cecc2619070455db5729fa4992521543f019f3f18a6aa4

SHA512
844df5b8ec1605888d27596df03aa524a6de0e6d22bf38befe1e8f23b18601372d9584f025cd7275867642c8c089499b8f6bd8070e9e2b9b7b2fa97456144f95

Download Submit