354f58076d89492a4981405a3c62f569be8a7505beca5f9443a9b649f8c6bbd7

Analysis

max time kernel
1711s
max time network
1166s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 13:50

Target
MoneyPrinterV2-main/src/status.py
Size 1KB
Sample240302-q5e21sec54
SHA256 bf656074d7f07688f25adaa931d573c3ebad7d9cc553ac6ec90e2e648dfb8971
MD5 b04ae87ec68b5e293fbd0a47936fa99c
SHA1 a152acd0fb2078d876deb7c70a8aa84d06436275
SHA512 7173256bbbf9a63880a07f847af92649a6781e70c200e08955013cbceb8c7d8ce5638f87dbbe1e33afb7bcf37a97934209d1efcb7f3e106eaa17f0608526b7d8
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\status.py
1⤵
- Modifies registry class
PID:3956

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact