Analysis
-
max time kernel
67s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03-02-2024 16:25
Behavioral task
behavioral1
Sample
NitroGenerator.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
NitroGenerator.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
creal.pyc
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
creal.pyc
Resource
win10v2004-20231215-en
General
-
Target
creal.pyc
-
Size
32KB
-
MD5
0a0ef875b8d00cf5851e317112ac9c6d
-
SHA1
2f18340880110a821f8a9d7048d69ebce531f5d8
-
SHA256
f2350af9c5f10dd15936d9e7185301911e2cf8859fe68aa57642ecb4b586f8c7
-
SHA512
f529fa38b5cb445d3eb1c1b7afc3f091071993b1a097078eebeed3248f27938b2d8ddecd190caccaf0f752552be709fefa87fbe8e148e7b3a4039d3345448744
-
SSDEEP
768:L8Dnri2VsfNEiyAuAfKFMrRtfqtvEwS7bnjerAroaHDsIAvN8YC06X:Ijrwe3aKFcfDwS7fOPviYD6X
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2832 AcroRd32.exe 2832 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2784 2372 cmd.exe 29 PID 2372 wrote to memory of 2784 2372 cmd.exe 29 PID 2372 wrote to memory of 2784 2372 cmd.exe 29 PID 2784 wrote to memory of 2832 2784 rundll32.exe 30 PID 2784 wrote to memory of 2832 2784 rundll32.exe 30 PID 2784 wrote to memory of 2832 2784 rundll32.exe 30 PID 2784 wrote to memory of 2832 2784 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\creal.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\creal.pyc"3⤵
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD588718fb488276b5eff315a4c7360767c
SHA120ae7b0f31d2dd3195710adc2181c756b01ce3b2
SHA25657a50274f77478864b0973fb066154c469bb98aa6cdc3e69a9de7ff3c5d112f4
SHA51289a6e959481776879b890b51c870a72eb2a7623210d2729c07ebd6181f73922076b3a56c4c5cf7829a1cfae3aab309f1f79ba4bdfc6f60b1d69cbd31198c5a0b