76e876aafac2ca23f4e0fd2e4f64052ab4d4235ccc9f8162c298e566e34101a8

Resubmissions

27/04/2024, 14:10

240427-rg3c3scf2v 3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-mass-dm-main/token-onliner.py
Size

3KB
MD5

f197d6e2eedc70faedd378e864cb2a64
SHA1

94cb7b5ba1d060185270b27b4a4ffb361c41d14c
SHA256

500ac31cf3781a1a8fc27a455c9ced77fce59af8d9c01bd0e8f1cf6f5684129d
SHA512

aa55b30e06036b699f4b307a0b1744cc10cac847d4abafe96d79e6cbbd3d2a969563654c09cdcd5a71153f76ed0ed9037ec06dfd8bc1c765bc3345c0ea147441

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1964	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	AcroRd32.exe
1964	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1612	2240	cmd.exe	31
PID 2240 wrote to memory of 1612	2240	cmd.exe	31
PID 2240 wrote to memory of 1612	2240	cmd.exe	31
PID 1612 wrote to memory of 1964	1612	rundll32.exe	32
PID 1612 wrote to memory of 1964	1612	rundll32.exe	32
PID 1612 wrote to memory of 1964	1612	rundll32.exe	32
PID 1612 wrote to memory of 1964	1612	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\token-onliner.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\token-onliner.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\token-onliner.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eb8f8bea635ee0a937c7adda51a7447e

SHA1
cead3a8f5cd8dd8dbab4ae4bec73554f78a99aba

SHA256
5532af15ade53cdaa49475c287a129fd93ac696bdd4b58368f1c5449e6a18911

SHA512
572417580252f6cef18546f9b2cbfcaf33b8b7fe5767ed0fe3eead70821f53aee888054367b2d96d144d076d90ea1714a5da7f38f620237ba6a1efaaa7d18ccf

Download Submit