9ee379ee8c7fd876158596597ebdb41a24d6cdbe1e28342c237b70f714c8edfa

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-bot-client-master/electron/package.json
Size

1KB
MD5

43fe302e1c850d31ae0c74d8f6fe6590
SHA1

f2d217857f35db4ea5e57e6bef7226311df4a336
SHA256

d8942144204cc49fdf4b3ce6b1868ea6820ebccaa411f713fe2f8cdc69556b7f
SHA512

c2bae739a85ca6d73c5ce4a78140c084af97ecac45597efc29354157684c1d80453aeceb988fd0c19e74af09b2727c3dfe0dc15c511522a6247010b38487992e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 988	764	cmd.exe	31
PID 764 wrote to memory of 988	764	cmd.exe	31
PID 764 wrote to memory of 988	764	cmd.exe	31
PID 988 wrote to memory of 2852	988	rundll32.exe	33
PID 988 wrote to memory of 2852	988	rundll32.exe	33
PID 988 wrote to memory of 2852	988	rundll32.exe	33
PID 988 wrote to memory of 2852	988	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\electron\package.json
1⤵
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\electron\package.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\electron\package.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d22c36ba3094005bedbb2932aca13e0a

SHA1
44264ef464c06e9aef3798958f517a238f8371a8

SHA256
c7cf0d88a35c1278d0f2c583a9f0ea1152ded2f79166fb5426348fadf3fe8509

SHA512
327c2e75184772a1b53af4e0e3eca1f689f64ff20fa4458675ad26d29273defdee8252302fae6d72227ffb2ea187ba9e8ae378febbeb37334107a22d974a2814

Download Submit