52986cb8456c4e017285d82fee09c48625584b18cdbe117ab05def250824fb32

Resubmissions

13/10/2024, 02:13

241013-cnmhwayapp 3

13/10/2024, 02:13

241013-cnes2atgja 3

13/10/2024, 02:09

241013-cljzzatfkd 3

23/02/2024, 03:26

240223-dzah5aba98 3

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Server-Boost-Botter-main/config.json
Size

172B
MD5

737fc1c1c32b23480fc1efe897979329
SHA1

cae0366bfb232c56878d8b2682dee21e5fc283d5
SHA256

59370b14b4435d1ee7a0ab8049df63deb10f225ac2d3314df219e9ff67098e07
SHA512

01d9e15bad0c5b939eaf694147a11934de47a3768a484afb0bbdad4e76fea35e49780416b3ecddf858ead976b2f59d791814d8ef74730f5cb647fe4d4c18239e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1164	2056	cmd.exe	31
PID 2056 wrote to memory of 1164	2056	cmd.exe	31
PID 2056 wrote to memory of 1164	2056	cmd.exe	31
PID 1164 wrote to memory of 2812	1164	rundll32.exe	32
PID 1164 wrote to memory of 2812	1164	rundll32.exe	32
PID 1164 wrote to memory of 2812	1164	rundll32.exe	32
PID 1164 wrote to memory of 2812	1164	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Server-Boost-Botter-main\config.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cfdfe8018e8e0c7b9907d056e331c8a8

SHA1
376080fb0f432d2f5e8b0c15518d813d2da26c7d

SHA256
541883b79c82919d872bf8057ffc94fe5816df996efb67947f0c83752215e639

SHA512
5df73681d15684f6d8bb32568ba2214e05607578c70e1bdb1ec0301118b9a794a91477315856586403e92457b5cafcf2bf7e3dc604dd4d5ba435f6dbd1234c30

Download Submit