76e876aafac2ca23f4e0fd2e4f64052ab4d4235ccc9f8162c298e566e34101a8

Resubmissions

27/04/2024, 14:10

240427-rg3c3scf2v 3

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-mass-dm-main/data/token_profiles.json
Size

250B
MD5

147bc90ef29302623cbc045f635d47f4
SHA1

af897f73ee950691443010c68a25388053cc4a11
SHA256

fa96feb6472cd455922d3ce3eb08f9de22aca31deeb38e363a706b02df78db40
SHA512

0f38a556d4db7876439f9cf339d60d8ae8066c0890975217e80121f01ba7fd1712d4bcc755d78d6c3688d75b50dee29a3e11ebff7da8aeac29e6509daa1c620f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 840	1612	cmd.exe	29
PID 1612 wrote to memory of 840	1612	cmd.exe	29
PID 1612 wrote to memory of 840	1612	cmd.exe	29
PID 840 wrote to memory of 2620	840	rundll32.exe	30
PID 840 wrote to memory of 2620	840	rundll32.exe	30
PID 840 wrote to memory of 2620	840	rundll32.exe	30
PID 840 wrote to memory of 2620	840	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\token_profiles.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\token_profiles.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\token_profiles.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dbf6d396ffd7ff1fdd55953576f7f295

SHA1
76e4ab4c6f5b9512685d5006c5fa346e2e119343

SHA256
2b41f682315ccc8b93db0f17aeb2f3057253d4ce07e571256c210ec827da0166

SHA512
43c11c98d593fa81e3059b2993edd5ed647e8b01800c13662a92258de9dc59e356ea5cb6beb51fabe62d8b751388cfcd261eeaadea81af5df71969a63c68f466

Download Submit