6eb5c94baf64a153b88d67430d2030d7460bcb83c288a1e3998b5ef9efd0699d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-de
resource tags

arch:x64arch:x86image:win7-20240419-delocale:de-deos:windows7-x64systemwindows
submitted
17-05-2024 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Token-Checker-master/README.md
Size

2KB
MD5

cceeec3819b8ac65c4058c2f107fa72f
SHA1

7bb85ddc5eb38c1fb76907452b0a235d4febd7cb
SHA256

c60531907f391658c45549c989150fe2cc24476fcf79fac98a2a7836dbee98ca
SHA512

4f6ae7b74d2f2c79bbd8f9ab0fe2ae90ba0286dfeb4f070a9e66d7025aafcc7ffafd2306e46c4f47e8772506934188aabc3518bbcf85fd974b98e3c672c2f45f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2764	2464	cmd.exe	29
PID 2464 wrote to memory of 2764	2464	cmd.exe	29
PID 2464 wrote to memory of 2764	2464	cmd.exe	29
PID 2764 wrote to memory of 2812	2764	rundll32.exe	30
PID 2764 wrote to memory of 2812	2764	rundll32.exe	30
PID 2764 wrote to memory of 2812	2764	rundll32.exe	30
PID 2764 wrote to memory of 2812	2764	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Token-Checker-master\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Token-Checker-master\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Token-Checker-master\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
024e6f2379e402ebaebec8bd488aa741

SHA1
673ec279a26d288757eca6f87ca61574209ccb8f

SHA256
6a6d5265bfd0d14f28ad14ff2daf8213a81c5d02c437f2b188c4caba36ae2fad

SHA512
5454fdfc0836ca7f6632cbe9f241c1b8d3d60e91de63894dafe907271aa8f0e3dc1ba7cb14832a2d0d8e9c4697782ce3528a4dfa26e006d0f8291a4d6356f178

Download Submit