073a3a554da262e3ffaced7bc3940c5ae2024cb0f457fe539df980326ac6acc2

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 14:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-Account-Generator-main/src.py
Size

18KB
MD5

62943794fc12c82e22cccfba4fed4939
SHA1

5e56e9f3e240bf7f49f93ae312284b33ebd6f50f
SHA256

2313dcf0ef3bac0e1ec528b396b7aad090b815a3820021aeda1208e37d71d413
SHA512

f5fa024c3ccc3e15a048b88b16aeaf3fbe23d9201ebb36faa03e7ba94c8acabf7ed5adf45db83b1f67098608129d98267e09d8b5b21b7f049c285c95d656e8d4
SSDEEP

24:MffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffK:X

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2840	AcroRd32.exe
2840	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2292	2536	cmd.exe	31
PID 2536 wrote to memory of 2292	2536	cmd.exe	31
PID 2536 wrote to memory of 2292	2536	cmd.exe	31
PID 2292 wrote to memory of 2840	2292	rundll32.exe	33
PID 2292 wrote to memory of 2840	2292	rundll32.exe	33
PID 2292 wrote to memory of 2840	2292	rundll32.exe	33
PID 2292 wrote to memory of 2840	2292	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-Account-Generator-main\src.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-Account-Generator-main\src.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-Account-Generator-main\src.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b1f7a16b76b4fdb889dfa5d70ad16dc9

SHA1
02a1582f7f4513f5ea74e704d17bfeccd93413a8

SHA256
e34f322a23e6e1ff8454ddea112ab6d6122f7cecf8d19cbd665b73d5531487a5

SHA512
f81cc9c7badcc5f2ce3f30a9e338743c95dd1ed1bbb431fc7437a7435f3359ce0b3101976927b37ebb6f94e926f7b204344e3a92ab17f1010bda52824a40bc5d

Download Submit