de02d7822ae6eed0166289527528640683c3011a74d181c8f9dcf84adc3289e5

Resubmissions

19-08-2024 16:28

240819-tyxv2avalc 10

19-08-2024 16:27

240819-tygh2sxhpk 10

Analysis

max time kernel
53s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-08-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TropicalBypasser.exe
Size

145KB
MD5

95f5058c852a269c21e732787d0b8f0d
SHA1

ce09b819d27ce21a420fa71d3b49fe123cd5f67d
SHA256

de02d7822ae6eed0166289527528640683c3011a74d181c8f9dcf84adc3289e5
SHA512

9ca2b383964df818e254472ee255ef882bcca287287e77d2271c47655846f1767f7867565832478a24c7ca57d0221ec0929f022d29242b82a6036abd74179c71
SSDEEP

3072:UVqoCl/YgjxEufVU0TbTyDDalQzacacacacacacacacacacacacacacacacacacR:UsLqdufVUNDa6

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 6 IoCs

pid	Process
3732	tropicalbypasser.exe
3424	icsys.icn.exe
3524	explorer.exe
1652	spoolsv.exe
2272	svchost.exe
3472	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	TropicalBypasser.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TropicalBypasser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tropicalbypasser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3424	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3524	explorer.exe
2272	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3756	TropicalBypasser.exe
3756	TropicalBypasser.exe
3424	icsys.icn.exe
3424	icsys.icn.exe
3524	explorer.exe
3524	explorer.exe
1652	spoolsv.exe
1652	spoolsv.exe
2272	svchost.exe
2272	svchost.exe
3472	spoolsv.exe
3472	spoolsv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3732	3756	TropicalBypasser.exe	81
PID 3756 wrote to memory of 3732	3756	TropicalBypasser.exe	81
PID 3756 wrote to memory of 3732	3756	TropicalBypasser.exe	81
PID 3756 wrote to memory of 3424	3756	TropicalBypasser.exe	82
PID 3756 wrote to memory of 3424	3756	TropicalBypasser.exe	82
PID 3756 wrote to memory of 3424	3756	TropicalBypasser.exe	82
PID 3424 wrote to memory of 3524	3424	icsys.icn.exe	84
PID 3424 wrote to memory of 3524	3424	icsys.icn.exe	84
PID 3424 wrote to memory of 3524	3424	icsys.icn.exe	84
PID 3524 wrote to memory of 1652	3524	explorer.exe	85
PID 3524 wrote to memory of 1652	3524	explorer.exe	85
PID 3524 wrote to memory of 1652	3524	explorer.exe	85
PID 1652 wrote to memory of 2272	1652	spoolsv.exe	86
PID 1652 wrote to memory of 2272	1652	spoolsv.exe	86
PID 1652 wrote to memory of 2272	1652	spoolsv.exe	86
PID 2272 wrote to memory of 3472	2272	svchost.exe	87
PID 2272 wrote to memory of 3472	2272	svchost.exe	87
PID 2272 wrote to memory of 3472	2272	svchost.exe	87

C:\Users\Admin\AppData\Local\Temp\TropicalBypasser.exe
"C:\Users\Admin\AppData\Local\Temp\TropicalBypasser.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756
- \??\c:\users\admin\appdata\local\temp\tropicalbypasser.exe
  c:\users\admin\appdata\local\temp\tropicalbypasser.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3424
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1652
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2272
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tropicalbypasser.exe

Filesize
10KB

MD5
6d36b9cb5dfb61a56eb9c7f58dcb3b15

SHA1
3603a2b8123d5e0181244bb3441c5214a95cee05

SHA256
715f014c3de487a70a0f010aa84053ec86614ae8105a2bc67bae26a962fe92fa

SHA512
a241967abf94e3f9a50ffd02b4d1bc5654520e95ec8cc6cc2b61e61a5e84489d54f68aad07cc7b0a9c725f5250ddbe4a7eb1365b9d8eef3b416d0d7e570ff350

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
01b9c3a3d80a67fa76672cca244a2d13

SHA1
439966f7b41ae5fbb88f39c4c8c7414b3a79cc68

SHA256
2810fd94276098800acc4bc500f690e00b51c47febed1f232f0ecbb0ed797487

SHA512
a8a7cff4072676dd37e2a77d18c244a5d4479fba65deda5107eaf998c9e19e5f3fb712dfdafc3a652914a03505c559b01c31d4cdb604bfeca352135ad0740e4c

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
1240b1978a2798d0445db79a50f74d40

SHA1
2097f3e41458d994e634c3638fca660a6d06f36b

SHA256
a1e15f0c40e7e68bbff49426aae7ced97ba8666ce932797302eaf5c24ea7e4e0

SHA512
37ffeb6f028ac8b23688e5d901672546a22963470e31c38c3a50f53f3ec7ad273627e8d180325f1bce329ba0882dac842fcedef2e6df6a51c51997b4dfc8132f

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
623a5e8a42c6cc698d39e23c7e256771

SHA1
3ccb59aafbde2e07b31c6e97e2be9f0362203bbe

SHA256
eb522e3180a58e8b39f87c041091c34b97143b72bdaa48cf5833d2c4b8fa0fe7

SHA512
6d29c7751d215bd0b81f0e4a42860ed0bb27341a9b0f38c8e3ce48ec21edc45388ac350f5d3ef7e390b9f3a36e1a89a92d080e16735a678f39ad6e716af04075

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
b8f6e090a370845cea7e5dbd04a52825

SHA1
e2cc2da7228f7891078c17ef90e02552bc861162

SHA256
c5de740a6b868cf5880eafc8eeb9821177ba12b9db702c7ad78c59cb582d5616

SHA512
d2dbfcad84f5f5324f33cccb2fbe731ad179fa6b9e2c2086ebb03aba0ea2689a4c09c41528f89843154dbfaf4a3db89f732cb12a1ccc368e70975dd9922f0616

Download Submit
memory/1652-50-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1652-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2272-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3424-51-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3472-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3472-49-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3732-23-0x0000000000070000-0x0000000000078000-memory.dmp

Filesize
32KB

Download
memory/3732-17-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/3732-41-0x0000000074D20000-0x00000000754D1000-memory.dmp

Filesize
7.7MB

Download
memory/3732-53-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

Filesize
4KB

Download
memory/3732-54-0x0000000074D20000-0x00000000754D1000-memory.dmp

Filesize
7.7MB

Download
memory/3756-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3756-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download