0d6e24e41bad37ce0f0fa2752d7f4e347d2c2b15272d18625ca895be20c61378

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

-CRACKED-Paid-Nitro-gen-Tropical-Nitro-Generator-cracked-free-main/Tropical.py
Size

3KB
MD5

9cd32b09f10bb67f4bee9c13c39a81ce
SHA1

90a193a4139e282f54b4b36f846876ffeef74071
SHA256

655e38151c09a2bb9cdeb59efa76d8d73baf7aaf424d4e6315022b514ab3c162
SHA512

04780e75b0db354af8f9ac35d428cc2f7c777f36fbaf6106dbe489baa3b6f3da6ed0f15baf82964bb69fa6d55fec1e2c761b0626cb4ffff1419f782350bba654

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2636 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2636 AcroRd32.exe
2636 AcroRd32.exe

pid	process
2636	AcroRd32.exe

pid	process
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2452 wrote to memory of 2524	2452	cmd.exe	rundll32.exe
PID 2452 wrote to memory of 2524	2452	cmd.exe	rundll32.exe
PID 2452 wrote to memory of 2524	2452	cmd.exe	rundll32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe
PID 2524 wrote to memory of 2636	2524	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\-CRACKED-Paid-Nitro-gen-Tropical-Nitro-Generator-cracked-free-main\Tropical.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\-CRACKED-Paid-Nitro-gen-Tropical-Nitro-Generator-cracked-free-main\Tropical.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2524

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\-CRACKED-Paid-Nitro-gen-Tropical-Nitro-Generator-cracked-free-main\Tropical.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2636

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
0693720dc58a1dbf9be99ff4e7e13a87

SHA1
2836fb257824485337f2384106c4e49ae2866e07

SHA256
bed89bfa29f02d46e465b0842ef718d6e370c19f5594d860c6753d2b8345cd78

SHA512
4deaf15e29bfa8705e83ad3a1f12512ae7a8ab163d844b7635cfab53f7d73a4b110b5784148200f444273bbdab82ae8178835f4589c09e1ead9aeebf0743eb11

Download Submit