498e1a7d867df07ffa85a9f56e34faf43988b54cc84107e4696a9039fdb8c059

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20250207-en
resource tags

arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
submitted
24/02/2025, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

discord-image-logger-release/src/components/startup.py
Size

1KB
MD5

d17d405ca05de43451c90ed876382851
SHA1

5d79d59b7c7d84da78b16c3b11ccc329a85974c6
SHA256

e93db849ec64a2c100f7d07bb1267edb96177b4097573796213fe19623b85e57
SHA512

7e2f8325cae28528d84fe1967ded6375d8b581d99a93d5b2dbae8f7a7af03c60cadacd21bd0d29771ccb0dc438e5aac30321f251db44124ab841f267a0ff887b

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	AcroRd32.exe
2820	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2912	2720	cmd.exe	31
PID 2720 wrote to memory of 2912	2720	cmd.exe	31
PID 2720 wrote to memory of 2912	2720	cmd.exe	31
PID 2912 wrote to memory of 2820	2912	rundll32.exe	32
PID 2912 wrote to memory of 2820	2912	rundll32.exe	32
PID 2912 wrote to memory of 2820	2912	rundll32.exe	32
PID 2912 wrote to memory of 2820	2912	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\discord-image-logger-release\src\components\startup.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\discord-image-logger-release\src\components\startup.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\discord-image-logger-release\src\components\startup.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5655cfbf488c9ed93c1c92c6887cad13

SHA1
c58ece13cee5553e55327b933b6b9cd1724309ad

SHA256
53b27f2aac3577c72b1cedec39c609d10f8d986d4504a29bfa93a8c4ae2cf1f5

SHA512
20c91d105131e254e1b4719c2bcadd1cc4b224aebe3327fb11d70b0323d126ec0f95633bb3bba36886f23b3fe11b6d943b30304f0de403e9a36205b139d6ba1b

Download Submit