Overview
overview
8Static
static
3A Installe...up.exe
windows7-x64
7A Installe...up.exe
windows10-2004-x64
4A Installe...er.bat
windows7-x64
1A Installe...er.bat
windows10-2004-x64
1A Installe...er.bat
windows7-x64
1A Installe...er.bat
windows10-2004-x64
1A Installe...at.exe
windows7-x64
1A Installe...at.exe
windows10-2004-x64
6A Installe...79.exe
windows7-x64
8A Installe...79.exe
windows10-2004-x64
8NPFInstall.exe
windows7-x64
4NPFInstall.exe
windows10-2004-x64
4x64/NPFInstall.exe
windows7-x64
4x64/NPFInstall.exe
windows10-2004-x64
4A Installe...64.exe
windows7-x64
4A Installe...64.exe
windows10-2004-x64
4GoldHEN-beta.zip
windows7-x64
1GoldHEN-beta.zip
windows10-2004-x64
1GoldHEN-be...en.bin
windows7-x64
3GoldHEN-be...en.bin
windows10-2004-x64
3pppwn GUI/....5.exe
windows7-x64
7pppwn GUI/....5.exe
windows10-2004-x64
7pppwn.pyc
windows7-x64
3pppwn.pyc
windows10-2004-x64
3pppwn GUI/...on.zip
windows7-x64
1pppwn GUI/...on.zip
windows10-2004-x64
1Unpacked/p...r2.dll
windows7-x64
1Unpacked/p...r2.dll
windows10-2004-x64
1Unpacked/p....5.exe
windows7-x64
7Unpacked/p....5.exe
windows10-2004-x64
1Unpacked/p...n_.exe
windows7-x64
7Unpacked/p...n_.exe
windows10-2004-x64
7Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 16:13
Behavioral task
behavioral1
Sample
A Installer/FileZilla_3.67.0_win64_sponsored2-setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
A Installer/FileZilla_3.67.0_win64_sponsored2-setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
A Installer/PIP Installer.bat
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
A Installer/PIP Installer.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
A Installer/Scapy Installer.bat
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
A Installer/Scapy Installer.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
A Installer/guiformat.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
A Installer/guiformat.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
A Installer/npcap-1.79.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
A Installer/npcap-1.79.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
NPFInstall.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
NPFInstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
x64/NPFInstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
x64/NPFInstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
A Installer/python-3.12.3-amd64.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
A Installer/python-3.12.3-amd64.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
GoldHEN-beta.zip
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
GoldHEN-beta.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
GoldHEN-beta/goldhen.bin
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
GoldHEN-beta/goldhen.bin
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
pppwn GUI/PPPwn GUI 1.5.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
pppwn GUI/PPPwn GUI 1.5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
pppwn.pyc
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
pppwn.pyc
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
pppwn GUI/Unpacked Version.zip
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
pppwn GUI/Unpacked Version.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Unpacked/pppwn/DevComponents.DotNetBar2.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Unpacked/pppwn/DevComponents.DotNetBar2.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Unpacked/pppwn/PPPwn GUI 1.5.exe
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Unpacked/pppwn/PPPwn GUI 1.5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Unpacked/pppwn/exploit/pppwn_.exe
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
Unpacked/pppwn/exploit/pppwn_.exe
Resource
win10v2004-20240508-en
General
-
Target
pppwn.pyc
-
Size
44KB
-
MD5
5c39d9e4d8d1d0274b1366a06ef543ce
-
SHA1
da05bc2b5bbfa45bc75801a6389a58dd4d124a49
-
SHA256
78a9c3146e1c2d0ad7d97771633aa89ce10aab0278f54814e96f522df098f6ca
-
SHA512
29c1b9fc9ad8dabb249a26363043ba111bea546f26c07bc774a9cf59c1b2c00931ec0b215fe0a29e172eb0a1257a4add0ebe8feb12d26b25969ce3b70b653295
-
SSDEEP
768:KUfnb9aQXfYcMHmX5GwyRbe8sOdz1xZjueRF1HM7S:rfnJBYYSe8DDT7CS
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2668 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2668 AcroRd32.exe 2668 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1512 wrote to memory of 2384 1512 cmd.exe rundll32.exe PID 1512 wrote to memory of 2384 1512 cmd.exe rundll32.exe PID 1512 wrote to memory of 2384 1512 cmd.exe rundll32.exe PID 2384 wrote to memory of 2668 2384 rundll32.exe AcroRd32.exe PID 2384 wrote to memory of 2668 2384 rundll32.exe AcroRd32.exe PID 2384 wrote to memory of 2668 2384 rundll32.exe AcroRd32.exe PID 2384 wrote to memory of 2668 2384 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\pppwn.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\pppwn.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\pppwn.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD52ae8a07d3fa038f83761df3f7e6dfc19
SHA1415aa0b08befc3420113be6cdaa65796efa34b19
SHA256c000f68105bd031eab501bcecbe38a039b8e1cb22d82097f4ab92a15056a4275
SHA5121175bf622cd048680256bbbe26a039bd0450f8db5d3ecc413d233bdc975856f43a93e283f08f2ff358a905b0bbe6cdea87cd83f1f9d682709bc4e98f34760d63