Analysis

  • max time kernel
    133s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 01:32

General

  • Target

    plpscripts_freeV2/plpscripts free ai aimbot/aimbot.py

  • Size

    45KB

  • MD5

    5437f4bbc2b19716d9a4f2edf94a418b

  • SHA1

    5a596bd86902d6358d01075fc9f8aeb3e60f14be

  • SHA256

    73e19d2af9ebd0b19f57519b5efacc655979078b9fa0680a8c1ea4857ca1a01e

  • SHA512

    bb3ed71217a62c7d544298c38bda92b94e98264e916b908ad8aef3b4703ecbdf9bbd4b939c77a7910dbe267618602d4a6d1eee4e8f808736a7847b2a98dc86f8

  • SSDEEP

    768:UpwyHVyltUFxclSRGA8D1I3/yKs/bub1Y3oNwyr3R+phZRoAcrukCq56rr3O9pjn:US8AlExWSR4HbuRN3w5GikOqpN/9rVdn

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\plpscripts_freeV2\plpscripts free ai aimbot\aimbot.py"
    1⤵
    • Modifies registry class
    PID:2572
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads