354f58076d89492a4981405a3c62f569be8a7505beca5f9443a9b649f8c6bbd7

Analysis

max time kernel
1676s
max time network
1172s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 13:50

Target
MoneyPrinterV2-main/src/constants.py
Size 1KB
Sample240302-q5e21sec54
SHA256 6fb69ee003bb1ec7c00686aecf5c2618b915b8b0fbd924c729331772662148c4
MD5 ca2cd13872a3a91be1351753c74c0669
SHA1 7443a9bc08d63e9174322b927feb7f0af78655a7
SHA512 ef5d0caf75cab97d000c5d478555a0d65f6238c627b36a044c7ed141d78c4601227a9a421f5282c934d1b2b79835494e67f010aa5e01542086e20c0e47d1c78b
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3424	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\constants.py
1⤵
- Modifies registry class
PID:1444

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact