c766263f5e7a70f0f77c53571d7fd10f7434df7d0a9d93139ef4655553840273

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TheBigTool-main/Settings/Program/Discord-Bot-Server-Nuker.py
Size

8KB
MD5

1eec55d5cedea356714dbdbacf0fbeec
SHA1

32985ba890607b4bd49377372fd7ef07a48d837c
SHA256

48b97070d2f51cbebbbac5d9d7d8cedce3545239d1aeb9aeff7919dba4edf3dd
SHA512

ac6bd0b41b813c9a38717513c1514279c7e0aa0f81bdd8a1629b0476a1bc0ceef34a8774e4ce1a55affdf1212ae7a0ebcd850d05a915d45e59162c046a5b540b
SSDEEP

192:vXEdItxDTlBCuZCEfCMCcC0IChEqELznEqa:jNlBCuZCEfCMCcC0IChEqELznEZ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	AcroRd32.exe
2728	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2452	1144	cmd.exe	31
PID 1144 wrote to memory of 2452	1144	cmd.exe	31
PID 1144 wrote to memory of 2452	1144	cmd.exe	31
PID 2452 wrote to memory of 2728	2452	rundll32.exe	33
PID 2452 wrote to memory of 2728	2452	rundll32.exe	33
PID 2452 wrote to memory of 2728	2452	rundll32.exe	33
PID 2452 wrote to memory of 2728	2452	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TheBigTool-main\Settings\Program\Discord-Bot-Server-Nuker.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TheBigTool-main\Settings\Program\Discord-Bot-Server-Nuker.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TheBigTool-main\Settings\Program\Discord-Bot-Server-Nuker.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cc82385fd96ca2329d724fc94d0bbaf1

SHA1
935f43743a628a26f8aaea920b1d25d5c56b4a91

SHA256
b65dea664f96d1c57a0695e08b0fb6cdb7dca3cd7635912ded6f904374d9b0ea

SHA512
98a105dc03e420d9b5d195704c481decad12fa5d274c51e9b31d1cdff36ee90b6424be007e58f5c79b1067b1b3ad490e21276555ef28b40e70543231000be5f6

Download Submit