5641362511a32a806a5bf59e45b34628917e5ecfcc9fa48b8468c83811098467

Analysis

max time kernel
41s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 18:04

Target

discord_token_grabber.pyc
Size

8KB
MD5

fc5c154670d1fde5b5dc7b4315ec91dd
SHA1

2c81c6dd874649fdbe84a35f42c4ef16eeb96901
SHA256

eb97e01db022a591db40157b56e8fa38b123a4e479b58298b2a4fb0d4a4e4ada
SHA512

d9f37728c7737fe8408673c95d4846c49983506b86a65bdbb044088e4133608114cdf06f412959a01e48355c6d75b1d269435e9ea4ec2cba206377ffe6b579f5
SSDEEP

192:A9RJpCmujbInthfHPU06e11tDQErZjcFDe4z:KJpCmcGr/PjDLFjczz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1880	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
1⤵
- Modifies registry class
PID:4284

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact