Overview

overview

7

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

7

Resubmissions

01/09/2024, 00:50

240901-a67wesvfnp7

01/09/2024, 00:46

240901-a4zr2avgnb5

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://cdn.discordapp.com/attachments/1278348660991721493/1279603139544223820/TZ.zip?ex=66d50aca&is=66d3b94a&hm=733bd5650db7df7e36fb7e838232e29b48bb5842ceb1084601feee39839314f5&
  • Sample240901-a67wesvfnp
Score
7/10
steamdiscoverypersistencephishing

Malware Config

Targets

    • Target
      https://cdn.discordapp.com/attachments/1278348660991721493/1279603139544223820/TZ.zip?ex=66d50aca&is=66d3b94a&hm=733bd5650db7df7e36fb7e838232e29b48bb5842ceb1084601feee39839314f5&
    Score
    7/10
    steamdiscoverypersistencephishing

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Detected potential entity reuse from brand steam.

      phishingsteam

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks