Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03-05-2024 08:07
Behavioral task
behavioral1
Sample
DiscordNSR.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
DiscordNSR.exe
-
Size
202KB
-
MD5
dce58e168f842bfbfbe6d26aa60b2781
-
SHA1
ee971a8adf441ed47dbcbe636fc2eed58e832145
-
SHA256
e3dd4a2c939abd57b170c6c60bca32b5c2676810111b97d0e7dcb94cf5fe05a1
-
SHA512
d54bb1653d72edc32201311fc4a3be2d0755e1961688325912fd402caeeac3ddd5072299e4131eb8176160a95b938ee7f3506817bb4fd8762108725010a9d410
-
SSDEEP
6144:gLV6Bta6dtJmakIM5p06EzFNGW6/263FOhe:gLV6BtpmkOae92u7
Malware Config
Signatures
-
Processes:
DiscordNSR.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DiscordNSR.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
DiscordNSR.exetaskmgr.exepid process 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 1240 DiscordNSR.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
DiscordNSR.exetaskmgr.exepid process 1240 DiscordNSR.exe 3068 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DiscordNSR.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 1240 DiscordNSR.exe Token: SeDebugPrivilege 3068 taskmgr.exe Token: SeSystemProfilePrivilege 3068 taskmgr.exe Token: SeCreateGlobalPrivilege 3068 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe 3068 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordNSR.exe"C:\Users\Admin\AppData\Local\Temp\DiscordNSR.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3068