5df07fd8445b5f509f162b10ab611e86a153f2217bc73b4cf50a0d46741b01f7

Resubmissions

13/07/2024, 22:40

240713-2lpmwszflm 3

13/07/2024, 22:15

240713-16l7tszamj 6

13/07/2024, 22:11

240713-14ed7syhnr 6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/07/2024, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Discord-Account-Creator-main/source/anti.py
Size

274KB
MD5

599663119ad632f59503e067afb51a74
SHA1

185cd2754248b7d717f470617f2bd243c883b550
SHA256

b4931df9ebfc6e0261ebead5cb5c76d5154d46aa13424bc32a523fd20e16d56d
SHA512

63534b573ca6c96b0580b838005bbf0983cc88216b38f2a7c67b858e3adf0b03b685a40f5a433d771c04a65ccfa3c0a0a951fc8ff385d9222597fba6244213df
SSDEEP

6144:dR9KwCk6qeB4KWcSAXhsSFqdU40DeDeSt7vVP8Oi5OQRbu:sw5wReAXhdz4eo9EOi5O/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2076	2984	cmd.exe	31
PID 2984 wrote to memory of 2076	2984	cmd.exe	31
PID 2984 wrote to memory of 2076	2984	cmd.exe	31
PID 2076 wrote to memory of 2740	2076	rundll32.exe	33
PID 2076 wrote to memory of 2740	2076	rundll32.exe	33
PID 2076 wrote to memory of 2740	2076	rundll32.exe	33
PID 2076 wrote to memory of 2740	2076	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Account-Creator-main\source\anti.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Account-Creator-main\source\anti.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Account-Creator-main\source\anti.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f6919ae445ee36f91659f9577352ad3d

SHA1
a21fb472498b225727ea5a10045dd59961156815

SHA256
7067b36e70014cfcb2cdd8f545c2f90da2b10f8dc1c140c008da34fd1c2871a9

SHA512
dac956059bae2e6f16ebda0adc081cea0557b9b446f5e9ed303cb19cdf9837feb8fdb39002e84bf274345377af391ff2726e1da23a99682d421a0d5e9e915fab

Download Submit