3aebbd7a53be06f3baad3a42d2479c63c6286b3cdf6a88e7fb5117bad15f7d82

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-02-2024 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.pyc
Size

142KB
MD5

21a287ab9e0dbff6eaee53b6acd48e07
SHA1

413b23b99389b25a766d190bcabc821076ecd23d
SHA256

51248692f4638d79a61b3b83ebfe47f21a40cd0f1c43d312c8497f4c5226947d
SHA512

74dd1a0a8e5e543a03d0a0751f123d9b5d34d67d870dca782bc5132dd0719787aafed447b4673ce2e26fbb320939bc7c8d7266d1863d1d269281e85a54761797
SSDEEP

3072:H1+5IxGJ9Oiq3yQZuW3HRGr11g+/3hPJf/ir9ccHP/H4SYOmdcL5hz7akmx3z0wG:vC9V6yQZuW3HEr11g+/3hPJ3ir9ccHPX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2292	2264	cmd.exe	29
PID 2264 wrote to memory of 2292	2264	cmd.exe	29
PID 2264 wrote to memory of 2292	2264	cmd.exe	29
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30
PID 2292 wrote to memory of 2756	2292	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
455705b3e45829f47b997805c60ff8eb

SHA1
71fa022ed367af3b67804193ba26806f03af62d0

SHA256
d898bc8f13a4b4e3a7d0aa557a2dc8e1fbcb96779c0819e535ed2cb5de7f658d

SHA512
03fcf22957b76240e1819e39ee3fd78bdb9a8692a25651fe4b78ae9f4071f974264c80653a618644555403a4d96a402edabb3b42f1e834dbc801fc0cd918cd42

Download Submit