c0308e2ea71ff40ce878556504ed644435ec61502bd5d01941ed632ccec029f9

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-02-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

creal.pyc
Size

53KB
MD5

c4613570a264cabdb3dd3974fd525109
SHA1

e036095a3c1169350318b0e2c10bc925c5e18b34
SHA256

feac704a8d1ce23d48970088c2ff8f6a3e89b9ed2ba8f40ad9317db10256d135
SHA512

f4482d9afa76920a424bae58df763a49e63c32b2e37702fc9ea094944e600af26a1c3f27db750f752362e2417f19bea014f7e58108d6226f130ee5adeac1620d
SSDEEP

1536:2rhaqMamq3YwmQyLCipnml5ZOhLQmGwCo3gI:2l7MapmJpnDSoB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2888	2204	cmd.exe	29
PID 2204 wrote to memory of 2888	2204	cmd.exe	29
PID 2204 wrote to memory of 2888	2204	cmd.exe	29
PID 2888 wrote to memory of 2792	2888	rundll32.exe	30
PID 2888 wrote to memory of 2792	2888	rundll32.exe	30
PID 2888 wrote to memory of 2792	2888	rundll32.exe	30
PID 2888 wrote to memory of 2792	2888	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\creal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5604255aab32a7dc43eeae4f96cc186d

SHA1
6ab9773c0f735fac13b0e2ba7c968fc82d766047

SHA256
7f62e5a0e36658a5a73eb7b1b570d69a3b76b6d4388a354f846f51155271759c

SHA512
701f04a9f2fe4bd43f4cf13aaf589173cf4523863dd719257d049a4411257b49a2e4501de3291fea8491ae0c51daa8c627791f5a3560f5bf1b184391f59c20f8

Download Submit