354f58076d89492a4981405a3c62f569be8a7505beca5f9443a9b649f8c6bbd7

Analysis

max time kernel
1565s
max time network
1566s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MoneyPrinterV2-main/src/utils.py
Size 2KB
Sample240302-q5e21sec54
SHA256 9c0758ddf24b3d8e4c1de796845098579f205d23974b86e4cac207c7accf3430
MD5 88011a4e0fad8709c53918f575d1cf6f
SHA1 8f14c7cccf3ee56c8498775b16fffd2e0d3c4a93
SHA512 a7bbe5cca1c2602919e4390192c798a22ef17abaf85accb2343dc79dbb9d8dc8270621bb21c7fbcffbde6a0e947a9ec768280a56f89894200365a8da048c1689
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2752	AcroRd32.exe
2752	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2532	2180	cmd.exe	29
PID 2180 wrote to memory of 2532	2180	cmd.exe	29
PID 2180 wrote to memory of 2532	2180	cmd.exe	29
PID 2532 wrote to memory of 2752	2532	rundll32.exe	30
PID 2532 wrote to memory of 2752	2532	rundll32.exe	30
PID 2532 wrote to memory of 2752	2532	rundll32.exe	30
PID 2532 wrote to memory of 2752	2532	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\utils.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\utils.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\utils.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 14e454e64f872af844d4ece2d0eb191019dca409ffc896f70a3c4e0c6865a181
MD5 3f04823b8cda431550a2812e1aba62da
SHA1 ef4537193dd977e999970c0f0b4b9cdce213425b
SHA512 753d302140015db6250f45b7378d10acca9a2132dcbc74f84ca084c9fe58d68c066c8cd8c4be189a6bc80ac722851a95dcdc3ed6c456a843f8dba6ddc7322186
MD5 SHA1 SHA512

Submit Download