ecc43f3fc4baf32cef7abe3787101e278480341f124413216404ebb89b7babe0 | Triage

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Discord-Nuker-main.zip
Size

1KB
MD5

137afd31b54d3520018c094236eda7d5
SHA1

d235172bc9df13850fb45a49988c996bdfc68470
SHA256

ecc43f3fc4baf32cef7abe3787101e278480341f124413216404ebb89b7babe0
SHA512

ec0b7a84002911a7ff909616533cd30f5d50fb71e7265b653a8a1246ac5df954dd6988b356764a815903da2e91aa26096cf4101e044aee43eef88ccecb80af78

Score

1^/10

Malware Config

Signatures

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	1308	7zFM.exe
Token: 35	1308	7zFM.exe
Token: SeSecurityPrivilege	1308	7zFM.exe
Token: SeSecurityPrivilege	1308	7zFM.exe
Token: SeSecurityPrivilege	1308	7zFM.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1308	7zFM.exe
1308	7zFM.exe
1308	7zFM.exe
1308	7zFM.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2676	OpenWith.exe
2120	OpenWith.exe
4952	OpenWith.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Nuker-main.zip"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1308

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zOC1530CA7\bot.py

Filesize
2KB

MD5
5fe5f6cdee058ed6a88f837a67581559

SHA1
f9b50b372b7b529533dc042536b5bab521371f0c

SHA256
33736c324804cf303e265248c8197cc8952b7c85149c86fd55c21a88aeada98e

SHA512
18ee606ab6921245f35988de5d8351050779f43f5eace882b8d89d06742f5a3f08c5770bcee8ee876663e592dbe1d17de2adc4f087655d7ab32e0b66c305fdbd

Download Submit