63b3839dc82c4080192b0181cc8296f1ff1841e2c820260d41544795d70415c5

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-06-2024 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-image-logger-main/src/components/injection.py
Size

2KB
MD5

1bfaa460966bb67499e24c44e2ae4f3f
SHA1

d79d21cd4518324d0c59fa6e183bc91df1c08433
SHA256

a9d1ad9132081e78a68e9bc71d315b74b4005f67e2667dc933db2be79e297e6c
SHA512

6e1fe9f8a5359abb7409f5b6177908968d5714dabb6e647b7a63c88ae02f06d7c16acb13895d896688ca4558ee64f2f80f2b02ec37879bd5b4b4bd7b5c66221f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2720 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2720 AcroRd32.exe
2720 AcroRd32.exe

pid	process
2720	AcroRd32.exe

pid	process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2880 wrote to memory of 2656	2880	cmd.exe	rundll32.exe
PID 2880 wrote to memory of 2656	2880	cmd.exe	rundll32.exe
PID 2880 wrote to memory of 2656	2880	cmd.exe	rundll32.exe
PID 2656 wrote to memory of 2720	2656	rundll32.exe	AcroRd32.exe
PID 2656 wrote to memory of 2720	2656	rundll32.exe	AcroRd32.exe
PID 2656 wrote to memory of 2720	2656	rundll32.exe	AcroRd32.exe
PID 2656 wrote to memory of 2720	2656	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\components\injection.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\components\injection.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2656

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-main\src\components\injection.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2720

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
4c0e5d6baf01033294d2da58c8cc261e

SHA1
c457f4001fe4e70d509e7ea0cd229cb8bc6bd0d6

SHA256
02202dd5f72dd975806b576d816f131a68651ec643438124104d0fc6ddd96dbe

SHA512
4ea2b705b746f9d78a268cec9d188f22bcf771fc9fee704ddaff190cb943132b0d68fdcf706c2d806c056ef8e3460cb7a741592f477362479514ea234cf98de3

Download Submit