Overview
overview
8Static
static
6Discord-QR...38.pyc
windows11-21h2-x64
8Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...ns.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Discord-QR...38.pyc
windows11-21h2-x64
3Analysis
-
max time kernel
437s -
max time network
445s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-11-2024 15:50
Behavioral task
behavioral1
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/__init__.cpython-38.pyc
Resource
win11-20241023-en
Behavioral task
behavioral2
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/__main__.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/__version__.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/exceptions.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/factory.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/locations.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/__pycache__/poetry.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/config/__pycache__/__init__.cpython-38.pyc
Resource
win11-20241023-en
Behavioral task
behavioral9
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/config/__pycache__/config.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/config/__pycache__/config_source.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/config/__pycache__/dict_config_source.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/config/__pycache__/file_config_source.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/__pycache__/__init__.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/__pycache__/application.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/args/__pycache__/__init__.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/args/__pycache__/run_args_parser.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/__init__.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/about.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/add.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/build.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/check.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/command.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral23
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/config.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/env_command.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/export.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/init.cpython-38.pyc
Resource
win11-20241023-en
Behavioral task
behavioral27
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/install.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/ins.pyc
Resource
win11-20241023-en
Behavioral task
behavioral29
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/lock.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/new.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/publish.cpython-38.pyc
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/remove.cpython-38.pyc
Resource
win11-20241007-en
General
-
Target
Discord-QR-Grabber-Bot-main/venv/lib/python3.8/site-packages/poetry/console/commands/__pycache__/config.cpython-38.pyc
-
Size
8KB
-
MD5
ea2a0601a7eac84f9516adf124756c83
-
SHA1
4a147ad9ff0ab1d968f8e78c1f848128fbfd2adc
-
SHA256
a98018b4592201f1759729086d67cd34fdf6f519f5af44459918aa815b8d51ae
-
SHA512
968aaba98d2e1917be8431b9e2b3f889e4d324886251e2c96ec7291cd11d5bf9acaa7fc24d8005fbbb4571524e5bdfe6a6ecfd6547b969b108f41cccd40c4091
-
SSDEEP
192:Hvclkrn20o7Zb7LY0e7DZg6Ym8qeH39rQeQl:HvUkClb7HenZyqeX9rQrl
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2700 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Discord-QR-Grabber-Bot-main\venv\lib\python3.8\site-packages\poetry\console\commands\__pycache__\config.cpython-38.pyc1⤵
- Modifies registry class
PID:1196
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2700