Analysis
- user interaction
yes - max time kernel
29s - max time network
35s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/07/2026, 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Injector DiscordCanary.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Injector DiscordCanary.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target Injector DiscordCanary.exe
- Size 36KB
- Sample260713-e4w4csdy8v
- SHA256 3ba4591b5fa8044e904faaf2be5a451acfb54854cff1bd9d8140c3f4c3d3fdb8
- MD5 dc67336635945f3e49b18d516fc95cf4
- SHA1 756d7e6c4b6a1dce24de5fa4e6857ccff6c7a2b2
- SHA512 6e6fba5f698c9c53901c652bd1e74e5f4f687d004cc5602b51676420aea46190ea8620148c0723751618f8990207b32e8054e6bb6b80e7f6f437249f5b514b5b
- SSDEEP 384:0B/FjtPLtdPSSKGSNqZArG4AsnTKw6YIVRuZoijtBKYkOlCtNRuZoijtBKYkOQnc:uPS5UZAr1Aa6fYToOhGHKT1
- TLSH T188F2C71ACE2B907BD31D8D75C9134D06DE62BCDADBD1B5DBAB400DE20865EA49B3D202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1972 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 960 Injector DiscordCanary.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE 1972 EXCEL.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Injector DiscordCanary.exe"C:\Users\Admin\AppData\Local\Temp\Injector DiscordCanary.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:960
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Documents\PushLimit.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
- Size 3KB
- SHA256 f5652d57031733223cbc6c642c3993c958ed951cb7b32b0ef4ab1796ef621fa7
- MD5 ce6004f760d797bbf48b0cecfece3e51
- SHA1 d45ad0cdbbefbd1ea55f06833af9984606fbab39
- SHA512 6ce8c64fff2f3466b68093d101bc17f392cdb484f77e5e2a808cea391fda1cbbb1629218b3b0514c787c365615896185156176ba1e704c72714c87a5e294bce2
- TLSH T18181140156C30F5BE074C23269368B53FB307E87DF16671E978C611E2DB0900AB2E92B
- MD5 SHA1 SHA512 TLSH