63b3839dc82c4080192b0181cc8296f1ff1841e2c820260d41544795d70415c5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-image-logger-main/src/components/antidebug.py
Size

11KB
MD5

26435fe69fcfe6322679c9df730cd0b0
SHA1

95a305df9fae655cc4b34eb0d5cad8848a4c9100
SHA256

101b5276bcaae253319cfc1f0f6b6a1688d9286c7852f8e12d00c698b2ae117c
SHA512

26e7750c235cfc734d86502f85f1620c4698bde6e377a2264bddd3017bb8891110e49ead665b59330666d2dd4686c8e657fb080554905dbb9976c8846781c963
SSDEEP

192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/V/c:0ZTd+nJYJzrn+rgeeWaOJjd5vpVC6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2732 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2732 AcroRd32.exe
2732 AcroRd32.exe

pid	process
2732	AcroRd32.exe

pid	process
2732	AcroRd32.exe
2732	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2236 wrote to memory of 2692	2236	cmd.exe	rundll32.exe
PID 2236 wrote to memory of 2692	2236	cmd.exe	rundll32.exe
PID 2236 wrote to memory of 2692	2236	cmd.exe	rundll32.exe
PID 2692 wrote to memory of 2732	2692	rundll32.exe	AcroRd32.exe
PID 2692 wrote to memory of 2732	2692	rundll32.exe	AcroRd32.exe
PID 2692 wrote to memory of 2732	2692	rundll32.exe	AcroRd32.exe
PID 2692 wrote to memory of 2732	2692	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\components\antidebug.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\components\antidebug.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2692

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\components\antidebug.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2732

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
4ede3106fb1d5e35da107d0ea4d61d5e

SHA1
04843c3f76a281891cc4ce81c2a9f94a906efb4c

SHA256
e0d0732ae27533346ddcbe06ef5cf45fc7d8a28e2c1a43cc3e8a9d47f1a80164

SHA512
95be9c5344d2a0b0cd975d2fdb57001700ed52a8645c01a3b468003838fac44394d9bed60912f39d47b9d2a3c2ee911583f4ea0ae606cdfe2869e2f35a42bd93

Download Submit