Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18/06/2024, 09:22
Behavioral task
behavioral1
Sample
Creal.pyc
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Creal.pyc
Resource
win10v2004-20240611-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Creal.pyc
-
Size
82KB
-
MD5
85b513e06d60766bf9d2e324fcce2108
-
SHA1
ba1af8ec4aac32f5333f39a73d16cc8da7307399
-
SHA256
6bdebac7fd9cd105c7d52cdc99e88e1dd486882509fccfcd2aed92a51ab17379
-
SHA512
01df4739559d10b2b840103b5d3a003ce4afbb42fe5fed18c43a1d894b8719cfb92813d370f21c1fbfca09c02ff5f6715479b23b8dfc3a43407576b241784b25
-
SSDEEP
1536:MupDrbe3uzTZMB7aK1ieL7iVX9hcuhFwNfb2GJjOZRJ:bpDve3uz0BkSGN9iOzOjsP
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2720 rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe 2720 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2732 AcroRd32.exe 2732 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2720 2116 cmd.exe 29 PID 2116 wrote to memory of 2720 2116 cmd.exe 29 PID 2116 wrote to memory of 2720 2116 cmd.exe 29 PID 2720 wrote to memory of 2732 2720 rundll32.exe 32 PID 2720 wrote to memory of 2732 2720 rundll32.exe 32 PID 2720 wrote to memory of 2732 2720 rundll32.exe 32 PID 2720 wrote to memory of 2732 2720 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"3⤵
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD565a33e4cbaa9715e81f88b9f30df7b45
SHA162765d5d66cde18057cdef58d6cd01233cdfdc55
SHA256121ab7817081355103ffb24e23a2e4826335ed8c2fe31b0685e438808a533773
SHA5125423da35c81ef02c90acad24fbe81faa85329f9218e4af20dcb6e71d2b43ad83a65a3097f04fce8b53f73600698503f6d738edde51bfbdaf79aad4fb9bed380d