77d6ec07a8226cfa71540f093be5e6d821fc36a43a4fbe927ae86eb2537c689c

Analysis

max time kernel
87s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
14-03-2024 01:06

Target

Discord.Bot-main/main.py
Size

22KB
MD5

7756766fa7bbf23992d9784bbdd498c8
SHA1

6a1012fb4a567e12a6b835d0cc54603327652571
SHA256

40e711c62dedd32a63d8cdd7d72ba53f45a9bc437647ba3240a9b8786e419b4a
SHA512

a296bb572741257563bd08afccdaf321223029b43e57d1e82a6a08ea8708e4289d598a5345cd448239e77ec70525b6a50a33e71622a9ddd2795e8b030c1b89c0
SSDEEP

384:vCC+LChHkG8qAkSHkRHk7HkyTCrdsOWghHUWZijIGHdfTVijragTCkS+AczTClE3:vCxQ+4+Jwd50fTEjOUFS+AcvEE26cRn8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Local Settings	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
280	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord.Bot-main\main.py
1⤵
- Modifies registry class
PID:2212

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact