Analysis
-
max time kernel
113s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 14:36
General
-
Target
Creal.pyc
-
Size
187KB
-
MD5
7277caa9e498af79ef25adbe4a698883
-
SHA1
0e2b92e38d12b1ea592025453022a4f66870b744
-
SHA256
c8188b2333d7fda9b4edf4f51765eecbbc8e22f3d680d7dd7609ad688bfcd0c8
-
SHA512
8cf98e76ab56634cc4e45de1350a14228cefaeef94a4f3169df5ab9fd5fa579194952e27be1d53fd01d4c9b5f712ddbc933d8f5c7ea7dbab6533789dfd28e081
-
SSDEEP
3072:qm+5IxGJduiq3y6AV3uotGzfedw/7YygTAHaBMbXdb7petXpSpV519TZsMgUOVvj:PCd16y6AV3Dtsf+wDY3TAHaBMrdb7pep
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 21 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB