354f58076d89492a4981405a3c62f569be8a7505beca5f9443a9b649f8c6bbd7

Analysis

max time kernel
1564s
max time network
1572s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MoneyPrinterV2-main/src/classes/AFM.py
Size 4KB
Sample240302-q5e21sec54
SHA256 b5dc6b8fecadd2b983ec4e10909efd854de374899653bd022a9016215518eb85
MD5 0d7b4d474580fa63d20acbca54882707
SHA1 adad73ee6033324168bc0551b0e439df74406503
SHA512 bf5f5e6c5efbac65541763cc21cf619beb8574b42916b64bb3798ee299f895c732e6ad150d8b66ae33e9bccc9f1fde9fd6f092988498895fe1ff536751fcbb77
SSDEEP 96:9qPC8jHDYx5BCZftit50vF6K3ISl0D1/h8RNwyDOoci:yv4u1OKMd+PRObi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2576	2348	cmd.exe	29
PID 2348 wrote to memory of 2576	2348	cmd.exe	29
PID 2348 wrote to memory of 2576	2348	cmd.exe	29
PID 2576 wrote to memory of 2692	2576	rundll32.exe	30
PID 2576 wrote to memory of 2692	2576	rundll32.exe	30
PID 2576 wrote to memory of 2692	2576	rundll32.exe	30
PID 2576 wrote to memory of 2692	2576	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\classes\AFM.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\classes\AFM.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MoneyPrinterV2-main\src\classes\AFM.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 5170a25b39a41ebe64339f2353935da54b9edc893007ebd0b23bb1527ae1a9d0
MD5 c7d849af7e7bff9bb44e573d678beb42
SHA1 d57f14ac53c4cfe49d09edac0a7fcf9cd98f2b0f
SHA512 e88af14985787a25501aa1cb20477c35bb494ed25672ac41b6d930f7ffa0d3da90d4b3d4a1233ee9aa9a28d3274c79be4df60140b552450b7f83e9796395cdef
MD5 SHA1 SHA512

Submit Download