4f41a91b11e77a5e4db83217ba6d367e3d93ecb8e91806e124c4dab5a63658be

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SkyNet-Discord-Bot-master/src/database_related.py
Size

10KB
MD5

72f2edfe142d73f28b5d1c51541894d2
SHA1

06bf7e43fc398894e07eb68b5878785cafbd0899
SHA256

4f057c2f8a1ef8eafc3deb51ee023dbd4a2d0c053779de5a224a75a41676019f
SHA512

ddb37071ee0dfb31a46cd9a06b2c7ca19e8a80391ba7ccb318a6c8973b3aa9e87be174deef91cdd255ff7ebdc72afa4c7205e2eb1c38f92359ccffc1f50114ad
SSDEEP

192:slXEbTXkPcZvPQZMks0yVGnZmzVEsgcsz6i202N:IEXFe+ercy639

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1412	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1412	AcroRd32.exe
1412	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2780	3064	cmd.exe	31
PID 3064 wrote to memory of 2780	3064	cmd.exe	31
PID 3064 wrote to memory of 2780	3064	cmd.exe	31
PID 2780 wrote to memory of 1412	2780	rundll32.exe	32
PID 2780 wrote to memory of 1412	2780	rundll32.exe	32
PID 2780 wrote to memory of 1412	2780	rundll32.exe	32
PID 2780 wrote to memory of 1412	2780	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SkyNet-Discord-Bot-master\src\database_related.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SkyNet-Discord-Bot-master\src\database_related.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SkyNet-Discord-Bot-master\src\database_related.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4a1e9b08838678d1cffb62099182bf58

SHA1
3754390cb63284b1b881a93caaa055007e69497c

SHA256
94a33de5b87105ed444fa0bfdbd3d19a0a0d7674918abf6a422a471a96c40398

SHA512
71e46466cf3c7ac21b29d3b5b9b4d356cceb660297cc2ba541ff7ac773710c42681a96a54d114516b249c64417087baf5d3c355f710cf4d43dddc14a8a4db9dd

Download Submit