a93af69230a1de24e63e9c955882fac184f8b429a3fb8e06a7cdb926e02725ae

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Token-Creator-main/hcaptcha.py
Size

93B
MD5

fa508a93ffd9151c844901ca39524d0d
SHA1

3fce80aa6bfc7edef4989896c4cc48a91c1fd49e
SHA256

9442bd2d986fddd454f3520c8ac45dacb65c9b9f211c09a67da8ce20495c8f93
SHA512

754701e39b99842842780b1888ec5a6089c0818aa0ba9b850e5a9778ea24094b2dffdc984e3b0d88426130c1f770ce9ba05f48b2e18adb3941411388be79ce45

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2976	2124	cmd.exe	29
PID 2124 wrote to memory of 2976	2124	cmd.exe	29
PID 2124 wrote to memory of 2976	2124	cmd.exe	29
PID 2976 wrote to memory of 2856	2976	rundll32.exe	30
PID 2976 wrote to memory of 2856	2976	rundll32.exe	30
PID 2976 wrote to memory of 2856	2976	rundll32.exe	30
PID 2976 wrote to memory of 2856	2976	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Token-Creator-main\hcaptcha.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Token-Creator-main\hcaptcha.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Token-Creator-main\hcaptcha.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7347df7c7411a5265aced9670664d2f0

SHA1
6b8bc1810a6887f71fb8fe9b163bdd0c0194fa25

SHA256
ed15767ebc18ffc8d939118294c306abbf9b748f39e5d82f0751a3781f31f042

SHA512
dfc1e98c9e9dafd759d55a2e2b083d9dce1dbe14a876255587d9a08d2259b9aef8cf478f2ba67be814b90252b1c33a38c8e73762f29ed11b5b2ea53a03e04188

Download Submit