1780ba40d833cf8aab745556f0a77673cf2f0d178805cc39afb765d5e4da7275

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Version-1-Tulpical.rar
Size

668KB
MD5

bbff361fdcc6f2dd16e19ab91ef98d18
SHA1

9e7d67052de93cc671423e427e8af683fc765dc2
SHA256

1780ba40d833cf8aab745556f0a77673cf2f0d178805cc39afb765d5e4da7275
SHA512

f0e8af2d7d386952893a8c841471cee1bb5378d22d52718488f4161eaf62075367a85c758869869946ed89fb82d0554f38d0fd1a0da9ae9bef48d79fe82dd66b
SSDEEP

12288:ztX5LKb0T5WPOaBEqNaTuwKPFxHBiUsmMVuR+i3GPvZdUd0DEty7qyYBbgTPBN3S:+w5WPOpqNa6wKPFxHHmiP3GHnK4wBbga

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe
2860	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2224	2584	cmd.exe	31
PID 2584 wrote to memory of 2224	2584	cmd.exe	31
PID 2584 wrote to memory of 2224	2584	cmd.exe	31
PID 2224 wrote to memory of 2860	2224	rundll32.exe	32
PID 2224 wrote to memory of 2860	2224	rundll32.exe	32
PID 2224 wrote to memory of 2860	2224	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Version-1-Tulpical.rar
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Version-1-Tulpical.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Version-1-Tulpical.rar
    3⤵
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...