f0b2a317afea99503ae32f64dd75ddf5d49e54f1f6ba0a2b77760b88124b4649

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MessageLoggerV3-BetterDiscord-3/README.md
Size

1KB
MD5

c5bdb10cc3f36a97df96147cc5bf11b2
SHA1

6e8c09ac5d5a93b6eb69c94ea74d6eb326eb755b
SHA256

c036f7c728586ced45f6e2a7aa212a72d6613bf32c7933c207a3b4f39d09502c
SHA512

6411573371c72e626920deb6f143e8af4167ef5e9042dde03c718036f2dcfc3867b798ebcf957b61d2eb29a90a51440075bb43ee28d6ff5fd3df05659bccf6ca

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\md_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\md_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2112	2840	cmd.exe	31
PID 2840 wrote to memory of 2112	2840	cmd.exe	31
PID 2840 wrote to memory of 2112	2840	cmd.exe	31
PID 2112 wrote to memory of 2576	2112	rundll32.exe	32
PID 2112 wrote to memory of 2576	2112	rundll32.exe	32
PID 2112 wrote to memory of 2576	2112	rundll32.exe	32
PID 2112 wrote to memory of 2576	2112	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MessageLoggerV3-BetterDiscord-3\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MessageLoggerV3-BetterDiscord-3\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MessageLoggerV3-BetterDiscord-3\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0646cc38ddb08ee333dad521b2e6b9f5

SHA1
47c62050f14cd368ada54537873ff3efc09d85a2

SHA256
a7ded429f504663b8894ff437651a7fb03544ced9efc171fb559cb8c4dcfbd15

SHA512
5a4f2652de4814bba9697745597f3020ae85e985a53af83ac62f8007d964a01c0518dddc7be03f10ca98af9cb4705f3babd65fe510f3987b3418156434375fa9

Download Submit