Analysis
-
max time kernel
71s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
04-05-2023 16:32
General
-
Target
Discord.AIO.exe
-
Size
6.5MB
-
MD5
7adc6022bb09db5e263fb294aaab2566
-
SHA1
77746a413c35573521c14eba036a2da5da68526a
-
SHA256
54bb1a394197df666003cd83a607b364b373c32df999c51f3c14bb830fc776ee
-
SHA512
21922589a3dc6fd2ccf4545dceb15249ca8882d946d9a29a90248dec55ed41b719d9d835381e0115a10d58957dbbc7ac3a277c2e1e88f398c672bed8e249a11a
-
SSDEEP
98304:27w0WYwOYA4vWVU4fgcmnH3EPIL6yFs9u/FpboNe7mZD7JOu9mq2Jo2N/03FIgcG:ts4vkmXas+6cOGR2JFNmWZCZ
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord.AIO.exe"C:\Users\Admin\AppData\Local\Temp\Discord.AIO.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB