2a0ed6effc97a4bdbe2555eff87407208190f2f709c6e592a92bd489c540ce65

Analysis

max time kernel
217s
max time network
292s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
04-11-2024 00:41

Target

Discord-Username-Checker-1.0.zip
Size

238KB
MD5

4dd2049a23974d09597d0dc6c9fe0ef8
SHA1

615aba2a1bc24102923bbd1fc736f2697379c2e9
SHA256

2a0ed6effc97a4bdbe2555eff87407208190f2f709c6e592a92bd489c540ce65
SHA512

ceb03d151aac16488648004fb6b841b6cc1f23095a04edc14d20461f0a52c5c9c85484558eaa3926b6d34230eab6e4383897690e9de5c0ce5a66b6b58de1427a
SSDEEP

6144:xzeHeDMs/eaCt5JVYXnrYJBhQOps7X3rlX3rqnR4nRFVZ8VZG:xKH8Ms/ePtknqBhBps7Zc8rVuVk

Score

1^/10

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
2072	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5076	7zFM.exe
5068	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Suspicious use of FindShellTrayWindow 6 IoCs

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1232	OpenWith.exe
5068	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2072	5076	7zFM.exe	86
PID 5076 wrote to memory of 2072	5076	7zFM.exe	86

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Username-Checker-1.0.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO4D302809\requirements.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1404

C:\Users\Admin\AppData\Local\Temp\7zO4D302809\requirements.txt

Filesize
18B

MD5
c9ae65f47721f7156a4e08aac85ed85c

SHA1
efe5e708feeceb6875df8593d5ece0086a9924bb

SHA256
83bf247199156685afb6c959da2302c6a9d33a16c420f67b46ffe0985da4cb05

SHA512
d1457193cfa802863325b74d1959eadd6879a0094a9c2395bc1c5fc63e43c408264c1c57afb4307e2fe4d402e4fb5f8540afb028e8e567c143e0abfbc5100f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO4D3FFCA8\dsv.py

Filesize
14KB

MD5
b022137af482840b9fc4a57f2a946da1

SHA1
18055704ab38ccdff922ae5d332fa7aa8aa2ad63

SHA256
d62cc03ec22215f600e529291b3e64a4e502b728a8588078cb3a5f0321289e05

SHA512
a996577e342a5ea04c7ca730217b0db042956b31e9be98a10976835a24526c7624f2324fdc4746e07c5bfef281e6902aa9dbaab63b50907bef8a73ea288c5302

Download Submit