Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 19:59
Behavioral task
behavioral1
Sample
creal.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
creal.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
creal.pyc
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
creal.pyc
Resource
win10v2004-20240508-en
General
-
Target
creal.pyc
-
Size
64KB
-
MD5
05317593399c25e6a5249f13e5d76dd9
-
SHA1
5cd013b76f29fb3f3558e39646b56ebee51dd6bd
-
SHA256
8aa67011091005839de572bb4f4b4e686fbbc39d2aa4437c3624609af5d6de66
-
SHA512
a09d24de48d2f8ad347865631b91e902715e6c6cb279c01c4ac50dede44b8ed3f9b46ae80a7b99293c67bf50c4c01ec82f09a77c98c592f25ffbc86c798efe8f
-
SSDEEP
1536:7Trme+0Ql9pObo8BHWftXASFW08VAeOR2e2:7T4Ybo8B2VXASNMAeOR+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2916 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2916 AcroRd32.exe 2916 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2800 wrote to memory of 2620 2800 cmd.exe rundll32.exe PID 2800 wrote to memory of 2620 2800 cmd.exe rundll32.exe PID 2800 wrote to memory of 2620 2800 cmd.exe rundll32.exe PID 2620 wrote to memory of 2916 2620 rundll32.exe AcroRd32.exe PID 2620 wrote to memory of 2916 2620 rundll32.exe AcroRd32.exe PID 2620 wrote to memory of 2916 2620 rundll32.exe AcroRd32.exe PID 2620 wrote to memory of 2916 2620 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\creal.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\creal.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\creal.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD50c4c8e62dae29089b07f1281cbea9da4
SHA1715924828d2158111d9ddd35711418f780ba7c5e
SHA25630c505980ccb1961c9afa16ba089102fb5f6c22b18c1e646b19816c9ffcc0bf1
SHA512d44e6e65ae78414767574c993dfc233b96a60a7b8442d1dcad780ee734d3ba5216fdb7f43542ad8163db3df19f15ec99159d300585dfb9d46e970280e701ae13