c0308e2ea71ff40ce878556504ed644435ec61502bd5d01941ed632ccec029f9

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-02-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

creal.pyc
Size

53KB
MD5

c4613570a264cabdb3dd3974fd525109
SHA1

e036095a3c1169350318b0e2c10bc925c5e18b34
SHA256

feac704a8d1ce23d48970088c2ff8f6a3e89b9ed2ba8f40ad9317db10256d135
SHA512

f4482d9afa76920a424bae58df763a49e63c32b2e37702fc9ea094944e600af26a1c3f27db750f752362e2417f19bea014f7e58108d6226f130ee5adeac1620d
SSDEEP

1536:2rhaqMamq3YwmQyLCipnml5ZOhLQmGwCo3gI:2l7MapmJpnDSoB

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.pyc	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2968	2304	cmd.exe	29
PID 2304 wrote to memory of 2968	2304	cmd.exe	29
PID 2304 wrote to memory of 2968	2304	cmd.exe	29
PID 2968 wrote to memory of 2840	2968	rundll32.exe	30
PID 2968 wrote to memory of 2840	2968	rundll32.exe	30
PID 2968 wrote to memory of 2840	2968	rundll32.exe	30
PID 2968 wrote to memory of 2840	2968	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\creal.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2840

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
690d0819523cfa126cfdb30db58a51ff

SHA1
2128b30656a46f0d93e4d311a0ce2cbcfd775138

SHA256
f2f96e3211312dd23b34f37b749f7db224d26ff25a9531a1e224d7e496cf6d4d

SHA512
bc2bc71f8425064dd41077b8c0e6a54b32fe09eafe27f096a7872373ea1e07f39c9b6a9b51c22ca60dbb51c6c7ecb5c12993246ad9d3be4913bb143b65c9a20c

Download Submit