52986cb8456c4e017285d82fee09c48625584b18cdbe117ab05def250824fb32

Resubmissions

13/10/2024, 02:13

241013-cnmhwayapp3

13/10/2024, 02:13

13/10/2024, 02:09

13/10/2024, 02:06

23/02/2024, 03:26

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Discord-Server-Boost-Botter-main/README.md
Size 920B
Sample240223-dzah5aba98
SHA256 f8e8b2137e61f5b61114e51dbded140d7c8a20f2496e78709380505c06736a48
MD5 d30c6fc79c056d4d4ed09743aa2155ed
SHA1 d7945ecc42584835610c1476d4b23e56564535cd
SHA512 6008d1207e8934f73a0531a0e5b5a8ff02d57b886d2848a6b7adb64e3da3f9c4881562feacd598df173b2c3f4911a084a53edd127f70c890a112f223b45ee1ca
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.md	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\md_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\md_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2708	2920	cmd.exe	29
PID 2920 wrote to memory of 2708	2920	cmd.exe	29
PID 2920 wrote to memory of 2708	2920	cmd.exe	29
PID 2708 wrote to memory of 2724	2708	rundll32.exe	30
PID 2708 wrote to memory of 2724	2708	rundll32.exe	30
PID 2708 wrote to memory of 2724	2708	rundll32.exe	30
PID 2708 wrote to memory of 2724	2708	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 103124a261186725166ae2e35f6f68e27d95cf2eee8543b925c035ccb517c29b
MD5 797f9d3453a7ad1a629bd262a01c199f
SHA1 39989856ec2733c816f6e51260f064d69c3a6d47
SHA512 fad9fa462315a10e8e627ca2d34327d6d52d786beb4f8693ff77c2bce2970a829f2d63db47dfea4ea8a251ade60c5c889f7a120bd3cf0daa0d5da8ae411d0500
MD5 SHA1 SHA512

Submit Download