a93af69230a1de24e63e9c955882fac184f8b429a3fb8e06a7cdb926e02725ae

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Token-Creator-main/setup.py
Size

102B
MD5

d30b6676535358f1c3c884576023cc82
SHA1

15c057ccc3a9a8710a46ee02f5a4f99254287654
SHA256

98f4df53dd2531b7aac9744f250e43cafcb5d3a7be205863853575e965e797fa
SHA512

522d97e86ed85eca0517bc4fd39d900665256e5ebfc1a74772648cddb53af7a631b5c3dca6c49e8a4587e905087b66c12d1c33ac541f89795a2a26f2d20df9bc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2716	2288	cmd.exe	29
PID 2288 wrote to memory of 2716	2288	cmd.exe	29
PID 2288 wrote to memory of 2716	2288	cmd.exe	29
PID 2716 wrote to memory of 2724	2716	rundll32.exe	30
PID 2716 wrote to memory of 2724	2716	rundll32.exe	30
PID 2716 wrote to memory of 2724	2716	rundll32.exe	30
PID 2716 wrote to memory of 2724	2716	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Token-Creator-main\setup.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Token-Creator-main\setup.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Token-Creator-main\setup.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a02c395fcb5505d1c2be55f438fff998

SHA1
9d2f0bde9bc15c2e284a0c27a9e0d7d50fc981f0

SHA256
454668e9a47f93d36a290fb0b9e6147f0301762de31826b478739f478869de22

SHA512
7186251b00433eb7c97b88680fe9611a67c3544246c25011768115f43a72a54885a720e405d5f9dfd614b8886d4df4f4f02f571ae79f5545b18cfc00b873b7db

Download Submit