543716cf3dfbf699bdc25710643bb151cae95e3e12f0006b4adf279665469c27

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

creal.pyc
Size

64KB
MD5

aa0a24ec6cf426fbb7e1e2a2b37acb06
SHA1

10eb0400cb996edfa28b0bda63f564660151553e
SHA256

bf22490aa5ce5edb54e64d9156f8a2baae7fe8a9f03ed306f3f1b975d8933807
SHA512

798e0572fefe88ed33feaa9ebb4ad34dc58f85819aedd95983403970fc63b38dfe1bb4536e2d4b4350b4a00ac1db9a32b9585028970a8410fead8f510c9cf600
SSDEEP

1536:7Trye+0Ql9pObo8BHWfNXASFW08VAeOR2es:7T8Ybo8B21XASNMAeORk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2636	1132	cmd.exe	29
PID 1132 wrote to memory of 2636	1132	cmd.exe	29
PID 1132 wrote to memory of 2636	1132	cmd.exe	29
PID 2636 wrote to memory of 2576	2636	rundll32.exe	30
PID 2636 wrote to memory of 2576	2636	rundll32.exe	30
PID 2636 wrote to memory of 2576	2636	rundll32.exe	30
PID 2636 wrote to memory of 2576	2636	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\creal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d03e688857d27e9be305c1f799561710

SHA1
a8ddf0ee1c344bdc73ff242a5984e17ee604b876

SHA256
7073c8c54034747285b2f089d98f4ba7dceecffab7eba6183ef5fb7b02492379

SHA512
9ee335774e09c65ec6a0b32707f97f9f4c552dd24014e9f76fac43ab9d55da6f6826f4aa72dd48945e1eb19cbd7e1044251aa543ec4fb76c6a5629c4bc097785

Download Submit