9ee379ee8c7fd876158596597ebdb41a24d6cdbe1e28342c237b70f714c8edfa

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

discord-bot-client-master/.gitignore
Size

103B
MD5

e69e65bcb0475d180edabe269f41ceb1
SHA1

b453e58109d60c41eb8e539307b558013fd335d8
SHA256

ce424e60b733e4e5eb14d2c0033bce2a2af89e5d725619316829b925bb134424
SHA512

3cdf5cc1524906d62f950217cf16953d0485ad7252aee8940a75f0bccf8699133263f8d5250be88393ca34d1fb52c47c81326621e8f3ebb94a3dd5e2176f33f9

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	AcroRd32.exe
2820	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2692	2420	cmd.exe	31
PID 2420 wrote to memory of 2692	2420	cmd.exe	31
PID 2420 wrote to memory of 2692	2420	cmd.exe	31
PID 2692 wrote to memory of 2820	2692	rundll32.exe	32
PID 2692 wrote to memory of 2820	2692	rundll32.exe	32
PID 2692 wrote to memory of 2820	2692	rundll32.exe	32
PID 2692 wrote to memory of 2820	2692	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\.gitignore
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\.gitignore
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-bot-client-master\.gitignore"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
52bfeddcb870ff74b385af03322e1856

SHA1
624a5869e31cf7a7a3655b5ff1b014ccba3c2a57

SHA256
1850b1a8af94d74daec8af9d16fa2a750cb1a36df053fd9c73c883f49188d54f

SHA512
18fd948ad06e708e3f60349957190b16a491b1c6b5ce8297a5b31b0fea254b714e670d25c7d6405edb910eb7bfd4a99efa20df27381ba5d84f5e724444ea1a98

Download Submit