a3b7ca2eedb0fc1c76c48264a0c863e9cda615d5d41adbc7a16360e6d407f738

Resubmissions

21-07-2024 21:54

240721-1sp2kawgkg 10

30-10-2023 09:49

231030-ltj5dacb8v 10

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Creal.pyc
Size

29KB
MD5

5f3bb95ca8adfdf1fcb79f63bd51722f
SHA1

c083a2e5768c5d8ea1cf32585b9464bd1390b273
SHA256

2559c00f81fb713ddaf533918e23f4003cf923650590ba389a4f2202a8be6826
SHA512

d8eb9755266206b5732a49c5d13d7b4f433d07c4bf4848a1d4155a9107e6978b21cf4ab046b68cefbf2342a6b7ae39663b12d686450fa12992a65588edf3489f
SSDEEP

768:3+lVSjnrw2VsfNEiyAuMMIfznTZMdpV7ISrx5HwtvK17Cvr:30SDrKe3uzTZMB7aK176r

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2748	AcroRd32.exe
2748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2616	2604	cmd.exe	32
PID 2604 wrote to memory of 2616	2604	cmd.exe	32
PID 2604 wrote to memory of 2616	2604	cmd.exe	32
PID 2616 wrote to memory of 2748	2616	rundll32.exe	33
PID 2616 wrote to memory of 2748	2616	rundll32.exe	33
PID 2616 wrote to memory of 2748	2616	rundll32.exe	33
PID 2616 wrote to memory of 2748	2616	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Creal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Creal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Creal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
49c5de512066e7cf62ad0c31a9127f72

SHA1
2be21f4e2bf8705523a17249c9d5578bf40001a9

SHA256
9b264610209b581bece9efb74ebddeb8f4bd2b30711eccf29bf2b0bf93455f47

SHA512
085aef3f5693331e950e5eddd40bd7bc5108d357d5248af5fc2d2df0540890f9df34561cce62c4390d9311e60bde09d343df8a14313b49c0d031e7cc3485f72e

Download Submit