Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23-01-2024 02:48
Behavioral task
behavioral1
Sample
GDS Pizza Massacre.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
GDS Pizza Massacre.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Creal.pyc
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Creal.pyc
Resource
win10v2004-20231215-en
General
-
Target
Creal.pyc
-
Size
166KB
-
MD5
2d39008b1ed6166c4c5950f36f333d33
-
SHA1
6339d203c155d96a407cb13356049506a2124cb6
-
SHA256
1364c4c10b6126976459d4b5c0b75b417fafa148bd28478034e69084147fbe5e
-
SHA512
df047a8fd84f921f52f969ab066ed15cfbee26bb61a7948374a9c42cb2b01008c176a324b50b30142f111c45ace95fcf9fac1171d674712e5fd2c37a3bbb1da8
-
SSDEEP
3072:56DQeZuz0y/SyFe+B0e/G9kmXucllEKl+xgV+MbZ+:Y8z9qQeOh/G9kmXBllEKlUoI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2720 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2720 AcroRd32.exe 2720 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2252 wrote to memory of 2196 2252 cmd.exe rundll32.exe PID 2252 wrote to memory of 2196 2252 cmd.exe rundll32.exe PID 2252 wrote to memory of 2196 2252 cmd.exe rundll32.exe PID 2196 wrote to memory of 2720 2196 rundll32.exe AcroRd32.exe PID 2196 wrote to memory of 2720 2196 rundll32.exe AcroRd32.exe PID 2196 wrote to memory of 2720 2196 rundll32.exe AcroRd32.exe PID 2196 wrote to memory of 2720 2196 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD57add2bb64ec1ddf666950b822c938f84
SHA1af2e4280afc1150772e93a80c1466b4ac1378455
SHA25669f070e15757573ca8d28c8301d41135436f2e6780c5f9407d02549cdee3d5a9
SHA512858d6f0e36e00f1d661b6d38e83a20069102c8ac11e2be63bd755c08b56751ff2df0b7673956a38c80600f4d03bcc969bfed9f8b40f1f993465717aaecf12f1b