52986cb8456c4e017285d82fee09c48625584b18cdbe117ab05def250824fb32

Resubmissions

13-10-2024 02:13

241013-cnmhwayapp 3

13-10-2024 02:13

241013-cnes2atgja 3

13-10-2024 02:09

241013-cljzzatfkd 3

23-02-2024 03:26

240223-dzah5aba98 3

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Server-Boost-Botter-main/config.json
Size

172B
MD5

737fc1c1c32b23480fc1efe897979329
SHA1

cae0366bfb232c56878d8b2682dee21e5fc283d5
SHA256

59370b14b4435d1ee7a0ab8049df63deb10f225ac2d3314df219e9ff67098e07
SHA512

01d9e15bad0c5b939eaf694147a11934de47a3768a484afb0bbdad4e76fea35e49780416b3ecddf858ead976b2f59d791814d8ef74730f5cb647fe4d4c18239e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2228	2036	cmd.exe	32
PID 2036 wrote to memory of 2228	2036	cmd.exe	32
PID 2036 wrote to memory of 2228	2036	cmd.exe	32
PID 2228 wrote to memory of 2676	2228	rundll32.exe	33
PID 2228 wrote to memory of 2676	2228	rundll32.exe	33
PID 2228 wrote to memory of 2676	2228	rundll32.exe	33
PID 2228 wrote to memory of 2676	2228	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\config.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
42142314252c79100e5140f4fdb4e0dc

SHA1
c67c4be5b20ad2313b68de4b35e956aa986ef425

SHA256
9f1ee5d3e62bf05337a6453fc29e0581da0186dc5ab34c44f863cb7d4a546ee9

SHA512
a282d232fd40f1aacebba4cd33711672493270b4c23f2cb891c33832134256941ca1d7fe14331b2f60494ca0ab6342ac6703d67a492794ffd74e360cacc41bfc

Download Submit