f6200c2c6a783b91beda7c166c26e6f0755dec715dab2cac71cf102c9242892f

Resubmissions

03/02/2024, 17:04

240203-vlj9vagdgl 10

03/02/2024, 16:59

240203-vhgdsaead8 10

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

creal.pyc
Size

60KB
MD5

dbc1ea3b8b872403eeef5fe8f1a57d47
SHA1

1c6f04b0af1e60be1bbd847e31c7a0f3e07a6e75
SHA256

be4bb432a30d02dd360e644edd6572091fb942450948c0cab503d35d4ea105a2
SHA512

c04dbb375d897a4eb411b1ef36bdb902f9f0924afa8bf757d145624665e8f8612c2764e3df9854dd3bdd4305cca707cf6a850bb413d34927aaa027a68363e011
SSDEEP

1536:ur/r+5Ixj33TRdOuamKbe9u6G4133Jbd/:u3+5IxbXasuN4133j

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	AcroRd32.exe
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2724	2052	cmd.exe	29
PID 2052 wrote to memory of 2724	2052	cmd.exe	29
PID 2052 wrote to memory of 2724	2052	cmd.exe	29
PID 2724 wrote to memory of 2828	2724	rundll32.exe	30
PID 2724 wrote to memory of 2828	2724	rundll32.exe	30
PID 2724 wrote to memory of 2828	2724	rundll32.exe	30
PID 2724 wrote to memory of 2828	2724	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\creal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
365a8dd367c32058f8c2b8024b40a336

SHA1
feceeb0b6064869abb44bb8e1917ed7c3971544b

SHA256
d8e68458427a96e8d12c3eb0d4380c4c8c5b3133c7edc48b82299ae94356ac2c

SHA512
11f1384ec0df810177a60a574de35667cc4ed481bc588aac8d938d98fc02d6769cbf3281c89b4caa8f1f61dd146cd7c81b3296014ec29ca2e90fc9c8d1f4b37c

Download Submit