76e876aafac2ca23f4e0fd2e4f64052ab4d4235ccc9f8162c298e566e34101a8

Resubmissions

27/04/2024, 14:10

240427-rg3c3scf2v 3

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-mass-dm-main/data/config.json
Size

322B
MD5

7fd4df9f762973862a3056f32cbcea79
SHA1

72b1d5a9e6dd8fa90ff060cb28ef775c7ca0192a
SHA256

937ceed57b940027b24ac6976d7f90df1e5307bead5c28288d3c9b3ba7eef237
SHA512

2c7a68996c1db136173a4fb07be5b09373cff9eb45b13df511cec6e412f4a1be707013a7fc191e1765e1c54fcb1d3ae9de1be1b672c87f8c5f8247fb0fb2606f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.json	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\json_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2284	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2284	AcroRd32.exe
2284	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2584	2208	cmd.exe	29
PID 2208 wrote to memory of 2584	2208	cmd.exe	29
PID 2208 wrote to memory of 2584	2208	cmd.exe	29
PID 2584 wrote to memory of 2284	2584	rundll32.exe	30
PID 2584 wrote to memory of 2284	2584	rundll32.exe	30
PID 2584 wrote to memory of 2284	2584	rundll32.exe	30
PID 2584 wrote to memory of 2284	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-mass-dm-main\data\config.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
08c69eac0a6a3a24b8dea7c2f9bb8d94

SHA1
7ea7504470a6dccb61acdd27adfa62f3d9bbc24b

SHA256
abb32e1514ed47ffa2a70f18641cfa3fb2bb89004c8d0ce16945daa3a8b181a9

SHA512
553119873135ebded01be937c30a827117259cb038c1691580908672f54a83ce35f3d9422066cdb5396da9e8280b34e2fd23c155c104e65f9b4b02c183e1a5b3

Download Submit