902cb042ac5819893b58e13bb275f8340e365bb00275647ed038630b4f8f9c2e

Resubmissions

13/01/2023, 15:22

230113-sr9qkshh37 10

13/01/2023, 15:15

230113-sm889ahg86 10

13/01/2023, 15:12

230113-sk86gade71 8

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
13/01/2023, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord Nitro Generator.rar
Size

2.1MB
MD5

1272913903f006257782576e54bc42f1
SHA1

2f0de1263f81ed61aed30911322ef0d8afeac200
SHA256

902cb042ac5819893b58e13bb275f8340e365bb00275647ed038630b4f8f9c2e
SHA512

e993bd3577f118f6aedbbf858f16caa15810852d9ea0f9c688d1a35b234764e32642dbf779b7722afc023b42c9d4ef4a53925abd7ee44e1896023c001edb849d
SSDEEP

49152:sw6z18UZYwYHEDhCOCTLbANtfZRpL5/oRlLjvM3:FkXeBCSTSBp/yxq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1780	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1772	chrome.exe
1604	chrome.exe
1604	chrome.exe
2452	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1780	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1536	AUDIODG.EXE
Token: 33	1536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1536	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1780	vlc.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe
1604	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1780	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1692	1944	cmd.exe	28
PID 1944 wrote to memory of 1692	1944	cmd.exe	28
PID 1944 wrote to memory of 1692	1944	cmd.exe	28
PID 1692 wrote to memory of 1780	1692	rundll32.exe	29
PID 1692 wrote to memory of 1780	1692	rundll32.exe	29
PID 1692 wrote to memory of 1780	1692	rundll32.exe	29
PID 1604 wrote to memory of 1996	1604	chrome.exe	35
PID 1604 wrote to memory of 1996	1604	chrome.exe	35
PID 1604 wrote to memory of 1996	1604	chrome.exe	35
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1092	1604	chrome.exe	36
PID 1604 wrote to memory of 1772	1604	chrome.exe	37
PID 1604 wrote to memory of 1772	1604	chrome.exe	37
PID 1604 wrote to memory of 1772	1604	chrome.exe	37
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38
PID 1604 wrote to memory of 824	1604	chrome.exe	38

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.rar"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.rar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator.rar"
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1780

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5cc4f50,0x7fef5cc4f60,0x7fef5cc4f70
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1660 /prefetch:8
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1216 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2484 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1512 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=992,5834988596653958318,2789233847249056291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download