97c9a5cab96e4fa1adcaf5da236fbb479d539d48392ade77efaa030d66d1f5c5

Resubmissions

22-06-2024 16:01

240622-tgf6ystbre 10

22-06-2024 16:00

240622-tfz8faxgkp 10

22-06-2024 15:49

240622-s9d2mashmf 10

Analysis

max time kernel
51s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-06-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.pyc
Size

126KB
MD5

07b4276b2cfd33972d53fbac3371981b
SHA1

89dd5c5b0ec049b1d079740061dfb5a179f73880
SHA256

7a80bea513ebcf6cc9482a24dcccd46e53fd17f68aca7072b092cff7eb2839ab
SHA512

6d326ba8d6c6c19bffdef5c5791fb5a55c5e1202f6916b30c7bc4b3372e38344cbfc05c6e5bbaa4b141e4649e0e6e73a9c7474cd5094e7c4c47cce0805a9b795
SSDEEP

1536:kr9aqMamgphoWdUeOPZZ4GQmGwWaMIwk/JsVAVMRSlxXDEJ0ZVRW5D9Kv1X57mGm:kB7MaNdU8dQ/KS1WXINLsnN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2856	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
1⤵
- Modifies registry class
PID:3264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads