Analysis date (UTC): 6 September 2024, 14:00Analysis environment: Windows 10 Pro, build 19045, x64

https://github.com/Smug246/Luna-Grabber

MD5:8FE53C0446DB4CCE820B4AF0039E5F64

SHA1:8299FD2ECD6BD056864CD4E7C1B369B57B418397

SHA256:8F79BBD7CD037A741B604779E112687C421A0A0943855AAC67084962DB1A3A6E

Analysis result

Threat level:Malicious activity

Full analysis:Analysis https://github.com/Smug246/Luna-Grabber Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Starts POWERSHELL.EXE for commands execution

cmd.exe (PID: 5796)

Uses ICACLS.EXE to modify access control lists

cmd.exe (PID: 5796)
cmd.exe (PID: 4008)

Powershell scripting: start process

cmd.exe (PID: 5796)

Starts CMD.EXE for commands execution

powershell.exe (PID: 4732)
cmd.exe (PID: 4008)

Detected use of alternative data streams (AltDS)

powershell.exe (PID: 4732)

Executing commands from a ".bat" file

powershell.exe (PID: 4732)

Application launched itself

cmd.exe (PID: 4008)

Executable content was dropped or overwritten

python-3.12.5-amd64.exe (PID: 7160)
python-3.12.5-amd64.exe (PID: 4160)

Searches for installed software

python-3.12.5-amd64.exe (PID: 4160)

INFO

Application launched itself

msedge.exe (PID: 964)
msedge.exe (PID: 7680)
firefox.exe (PID: 3356)
firefox.exe (PID: 5700)

Reads Environment values

identity_helper.exe (PID: 6232)
identity_helper.exe (PID: 4088)

Checks supported languages

identity_helper.exe (PID: 6232)
identity_helper.exe (PID: 4088)
python-3.12.5-amd64.exe (PID: 7160)
python-3.12.5-amd64.exe (PID: 4160)

The process uses the downloaded file

msedge.exe (PID: 4088)
msedge.exe (PID: 964)
WinRAR.exe (PID: 7388)
powershell.exe (PID: 4732)
firefox.exe (PID: 5700)

Reads the computer name

identity_helper.exe (PID: 6232)
identity_helper.exe (PID: 4088)
python-3.12.5-amd64.exe (PID: 4160)

Reads Microsoft Office registry keys

msedge.exe (PID: 964)

Manual execution by a user

cmd.exe (PID: 5796)
firefox.exe (PID: 3356)

Executable content was dropped or overwritten

firefox.exe (PID: 5700)

Create files in a temporary directory

python-3.12.5-amd64.exe (PID: 7160)
python-3.12.5-amd64.exe (PID: 4160)

Threats

PID	Process	Class	Message
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2256	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)