General
- Target attackversion MONEYMAKER MACHINE.py
- Size 23KB
- Sample260723-agf2eabk8s
- SHA256 7f9f3e927cefa99927f09c0385cb4b7b3e7598a7d6126807f5e045230158b0c4
- MD5 fc4dc28f7f971b4756c6a37bf5174492
- SHA1 b08205e0cb9653e919f98e80d897802fcb978d79
- SHA512 7f8bde266a09d4bbd0d5d06fc73973db121b084f226597e3141d447825c002edf146afecf81abbdb79d3908c9fd3bbd6727d4d2507983d0230b5230cbaaf3bd2
- SSDEEP 384:6SEeu0fwhJurMZ5CcIKxftJ8KWf6xxcxPfOnTTuaPWo2TIMqNS8UWPLUbR:1dpwhJ75vzxft/Wf67cxPfOnTTu4jgmu
- TLSH T1D0B2C5057D2625089353C855959FC4A3BB1AA807E60D0874BBFCD2F1BF8A17643B9EBC
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
attackversion MONEYMAKER MACHINE.py
Resource
win10v2004-20260513-en
15 signatures
900 seconds
Behavioral task
behavioral2
Sample
attackversion MONEYMAKER MACHINE.py
Resource
win11ltsc2024-20260709-en
4 signatures
900 seconds
Malware Config
Targets
-
- Target attackversion MONEYMAKER MACHINE.py
- Size 23KB
- SHA256 7f9f3e927cefa99927f09c0385cb4b7b3e7598a7d6126807f5e045230158b0c4
- MD5 fc4dc28f7f971b4756c6a37bf5174492
- SHA1 b08205e0cb9653e919f98e80d897802fcb978d79
- SHA512 7f8bde266a09d4bbd0d5d06fc73973db121b084f226597e3141d447825c002edf146afecf81abbdb79d3908c9fd3bbd6727d4d2507983d0230b5230cbaaf3bd2
- SSDEEP 384:6SEeu0fwhJurMZ5CcIKxftJ8KWf6xxcxPfOnTTuaPWo2TIMqNS8UWPLUbR:1dpwhJ75vzxft/Wf67cxPfOnTTu4jgmu
- TLSH T1D0B2C5057D2625089353C855959FC4A3BB1AA807E60D0874BBFCD2F1BF8A17643B9EBC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1