f1d5a873c18d634aa1c3d9646a021f357784dadcb1629f5d3bebf4ebac15a27f

Analysis

max time kernel
91s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-12-2024 13:07

Target

discord_token_grabber.pyc
Size

8KB
MD5

e65aa3a3452d4cc97930c3af058f1c10
SHA1

81065dc50886648e1895b4d4dda99fc21e2b28c2
SHA256

2468bc7f83adbcfd3c2fd86c3340ccc6f98aeec288f318494d1607907ffcd468
SHA512

0a45d12010203c5a5b33fae57892b7a812e1e0c7fbefbeb08bc1d7ad2e5bbf4cb4f8761bda29fc695808c30ec0569b7f5f039c2ea5a261108eb7ed7f2f71494f
SSDEEP

192:iQR8LslmujbQybyo5HptlYwqJFD7U6r18ZPuNz:vNmcQcpt+D7Ua18uz

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5096	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord_token_grabber.pyc
1⤵
- Modifies registry class
PID:692

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact