16cb2444d77690a7d213952c73dee55fcfaa9ea208031c8a39cd7ad873f38027

Resubmissions

01-07-2024 01:43

240701-b5gtaasdpe 3

01-07-2024 01:39

240701-b269rswaqj 3

Analysis

max time kernel
0s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TropicalExternal.pyc
Size

241KB
MD5

04505edbb32c39d12db73baf43cd81be
SHA1

d62de6fdefaf437f700b01ccf41b9447f0071ef7
SHA256

fd16174235bd428d7443e254b8d13b449d44939770ddc01fe1bb97d9127efbdd
SHA512

b9a67f07d2788637ebf5355a1ae308a48b6a3f0fd14650d79c09dcaa2cf2b1329c8a041aa008b9f4b54423f8df76a37cb9731c4c4ca850456b8dba86e1e90227
SSDEEP

6144:Ix//fDCpDA0ae5+Xv/UOUWeu8xMq4kXuZvhGVKQG:WfDyR5+X34W0Mq4kXQpGfG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2968 wrote to memory of 2668	2968	cmd.exe	rundll32.exe
PID 2968 wrote to memory of 2668	2968	cmd.exe	rundll32.exe
PID 2968 wrote to memory of 2668	2968	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TropicalExternal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2968

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TropicalExternal.pyc
2⤵
PID:2668

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TropicalExternal.pyc"
3⤵
PID:2864

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
bfff1530a797e8069bbc66c223a86807

SHA1
fcf2443246de6c8d11a89629edd4ade1cf23a490

SHA256
864b5122701fc778e8fb56af2a92766725a16d0e092e85e318ac73d066fbb645

SHA512
4046548eb343e76f39913f8bbf62f9af570039120e45e85f3d04a4e825bdc395f942476fb165c5e8f8360e64b5e00cb0602f8056df1243b5f1cd0e1b6532eaa6

Download Submit