139ef1acfc915e1a6663fa5cb60bec9121c18f037e099149eeaeaddd2c621dcb

Analysis

max time kernel
1486s
max time network
1509s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
20-12-2023 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.pyc
Size

55KB
MD5

918e51562ddd0e1a6c055a92abfab29b
SHA1

4028ce469058e3b400f70d99bf6014fba7823489
SHA256

67a3ca7b8769c9dd4d7a4b91e91a624937858f5eb3bdec20289fbce2a4e3a23d
SHA512

a40e06c2b15a76ec0993c98aa8c957f8f6c7d9822dd1d5cdd809f2d02a8878e292b81bd299fdb311afe3be39f7cba3171d37b261ffaa9cf16bd1621ea953b9a4
SSDEEP

768:s7WnrnpVIVzgN9+X6WYP1VxcwyWb5ttmPXFFYaoef8GM8ZKGeiq3+ee3eb3sO:DrDr+5IxcQKXFFYadzCiq3yeb3D

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\pyc_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\Ref\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\pyc_auto_file\shell\Open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\pyc_auto_file\shell\Open\command\ = "\"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe\" --started-from-file \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\Ref	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\pyc_auto_file\shell\Open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\pyc_auto_file\shell\Open\ = "Play with VLC media player"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-175642277-3213633112-3688900201-1000_Classes\.pyc	OpenWith.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2196	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5792	OpenWith.exe
2196	vlc.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2196	vlc.exe
2196	vlc.exe
2196	vlc.exe
2196	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2196	vlc.exe
2196	vlc.exe
2196	vlc.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
5792	OpenWith.exe
2196	vlc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 2196	5792	OpenWith.exe	82
PID 5792 wrote to memory of 2196	5792	OpenWith.exe	82

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
1⤵
- Modifies registry class
PID:1424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-9-0x00007FF6FA6C0000-0x00007FF6FA7B8000-memory.dmp

Filesize
992KB

Download
memory/2196-10-0x00007FFA57B50000-0x00007FFA57B84000-memory.dmp

Filesize
208KB

Download
memory/2196-11-0x00007FFA53FD0000-0x00007FFA54284000-memory.dmp

Filesize
2.7MB

Download
memory/2196-12-0x00007FFA422A0000-0x00007FFA4334B000-memory.dmp

Filesize
16.7MB

Download
memory/2196-13-0x00007FFA41A10000-0x00007FFA41B22000-memory.dmp

Filesize
1.1MB

Download