d861468d7b1fe97305d42cd3aee9b496e2a8e85570e3a5368b8b2ecebf18c45b

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flexibel/Pygalgia/medlever.jad
Size

2KB
MD5

18260dbf7014af5adc94692ae0d4150c
SHA1

ca0b5023c70a3ba59c3892823453ff3c4b1ded2f
SHA256

119213bd3c56720d9544d46a09f4b699248c9a0b05a83912374e2ead70f9090b
SHA512

e22c39393db9e92ed89c8a55aa04ee1d1601872c24764a3c3483fa166ebac8a07061e76b25add27a87e84de1f6aa0aa454cf7808704bb7a49e7e1147b4987cb0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	AcroRd32.exe
2876	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2552	2912	cmd.exe	29
PID 2912 wrote to memory of 2552	2912	cmd.exe	29
PID 2912 wrote to memory of 2552	2912	cmd.exe	29
PID 2552 wrote to memory of 2876	2552	rundll32.exe	30
PID 2552 wrote to memory of 2876	2552	rundll32.exe	30
PID 2552 wrote to memory of 2876	2552	rundll32.exe	30
PID 2552 wrote to memory of 2876	2552	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Flexibel\Pygalgia\medlever.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
db7e611b6b16470e3de77f3fb9affddb

SHA1
2e1cdf2f894a1a36420b99295175bf0ca64d2f2b

SHA256
5db81a8ae2bc2e9b7ea4b085eaa9f39253d7d1aa02101322b7ae700aeb594a94

SHA512
185427544b6ce0cea76088e1f7610a1f62dd6fbd45492d2864656727cd6452cf6883e2a25294233d2fac12d4d28ad247e384b648a27d0e777b058b6508925773

Download Submit