9ee379ee8c7fd876158596597ebdb41a24d6cdbe1e28342c237b70f714c8edfa

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-10-2024 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-bot-client-master/extension/images/128.png
Size

8KB
MD5

dc1b31dde5326f5e522d69bba08cca04
SHA1

c10594e8ae44e4a742875098545ab15d3c87d881
SHA256

d15d6a7e79f2433d2ec2d10400fbd896b164df3f3d0fefe84579d94ce92b0007
SHA512

50648015434d176a8bd9429a7ebdd4a8d80a6cf9f8404528ac8c277aace045c28b3295de9a70612eecd528a20599cb286a841bd68605b117d4767c38fac6b677
SSDEEP

192:ZKDBtry0pHT7KmCKPHuFCTqlJsTr/YfUOKqzpP/5vgMJeNwWi:ZqY0pzRz00r/YfvKEP/y2eNji

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2264	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2264	rundll32.exe
2264	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\extension\images\128.png
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2264-1-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download