5df07fd8445b5f509f162b10ab611e86a153f2217bc73b4cf50a0d46741b01f7

Resubmissions

13/07/2024, 22:40

240713-2lpmwszflm 3

13/07/2024, 22:15

240713-16l7tszamj 6

13/07/2024, 22:11

240713-14ed7syhnr 6

Analysis

max time kernel
102s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Account-Creator-main/source/discord/gen.py
Size

2KB
MD5

ab89e7549af0ec08589560cf15847f88
SHA1

932dc48878907cc643753385a0b9828ac343a2dc
SHA256

13c29939b838e877016644fc939344b8aeaa14c730970a584f4cf9461944c3fb
SHA512

63d033ca2ecd9a3a3141959d9beeb5199a85e9683b2058162628c4cf2ab9124a291ead166dc18746233d19c8612ccb08c8ba358cf7f4b7036507f6c05a68595f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1532	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1532	AcroRd32.exe
1532	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2756	1476	cmd.exe	30
PID 1476 wrote to memory of 2756	1476	cmd.exe	30
PID 1476 wrote to memory of 2756	1476	cmd.exe	30
PID 2756 wrote to memory of 1532	2756	rundll32.exe	31
PID 2756 wrote to memory of 1532	2756	rundll32.exe	31
PID 2756 wrote to memory of 1532	2756	rundll32.exe	31
PID 2756 wrote to memory of 1532	2756	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Account-Creator-main\source\discord\gen.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Account-Creator-main\source\discord\gen.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Account-Creator-main\source\discord\gen.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
af3819bfd51d97701cedf9ee11faf7c9

SHA1
8d1541b489b233acca11b384c755745b7653f03f

SHA256
95eaab0c83fc28bd4cd0717933dd8def802e85232c3e5fb979a7da4a37285974

SHA512
4e1558bf1f653d2fb2911715209259a5d8ba7ae62d25af55898e78c2429b56d39595cf47ea70d46a43bc4cf2e2428e9da29a3f11bf5f9494859b3cb91fe5b442

Download Submit