c9f301b4e6c05295793faaeadd2e942593d9259719623e2d6b2970b741ae225f

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

src/discord.py
Size

2KB
MD5

a378d3367ee38bdbda0d3d41138537c1
SHA1

b330346a072a6f8013dd742f8fcd810623248eb0
SHA256

b72d955382614847001e954ce566409499d1a7085904a5b59334870f8fde54f8
SHA512

21281b2a35a65da45c4e207340244e0ae7623399f2d0487d6e23d53723df59870b93f3404dde3e34fab38b9e408baac43e80e6226779f79273595a742bf70b6c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 2556	1116	cmd.exe	29
PID 1116 wrote to memory of 2556	1116	cmd.exe	29
PID 1116 wrote to memory of 2556	1116	cmd.exe	29
PID 2556 wrote to memory of 2660	2556	rundll32.exe	30
PID 2556 wrote to memory of 2660	2556	rundll32.exe	30
PID 2556 wrote to memory of 2660	2556	rundll32.exe	30
PID 2556 wrote to memory of 2660	2556	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\src\discord.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\src\discord.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\src\discord.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fd6811b6178da0df5574a82235bc7969

SHA1
e224aa14414b09592557358f4c6d79c7d372a896

SHA256
0a2272db5dab17cef579c85922a5d03e7c176d25358be32340beb7a1e4e7b7c4

SHA512
1051825acb7d8474e80a0646c9a80adc581a08b79f85ae2338a6036e5ec2256491f5029bc5b30035776c3d0023fbcfff55a21a2dbbb410791b3cc8bc2b8b0840

Download Submit