9309cbe621ced13494dd892250ea9ef33716713f316c384ad094b7dbd1ff73a3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CollapseLoader-1.2.5/collapse/utils/Logger.py
Size

960B
MD5

29c4a03305156dcc1c7b91e46730a50d
SHA1

c3c220b09c6725e27b34aed5a8c25869ce888262
SHA256

42fd1fa196ab45e090225bf088a65f66a559f0a8f453fd23a41082e7ee359095
SHA512

e82f7606dc07ff9229a95ce84dd64de34d5bb5ce6a5bc4b462887fedde3247818d9af40cd705a18ef373ef0cad70f5d100b66a408916e502a97cb02e703cdba4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2492	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2492	AcroRd32.exe
2492	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2628	1580	cmd.exe	29
PID 1580 wrote to memory of 2628	1580	cmd.exe	29
PID 1580 wrote to memory of 2628	1580	cmd.exe	29
PID 2628 wrote to memory of 2492	2628	rundll32.exe	30
PID 2628 wrote to memory of 2492	2628	rundll32.exe	30
PID 2628 wrote to memory of 2492	2628	rundll32.exe	30
PID 2628 wrote to memory of 2492	2628	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Logger.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Logger.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Logger.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4eaf4f5210f212ac9eed4d1d703e34ab

SHA1
b754a12907dc3064622ae52a26bb042dabf8b094

SHA256
a20e6509ab8a5878ffc55e84ff56c54d080fe3043cd949ea39e07950287644d4

SHA512
6451c2beb74b01e5b3883bbb180d9cdaa1dfd8109a41828226cecfe58788b9a88c2d3d43aeb767ddb7c8f312b8e4d4116539994a889efd36e282b821897e096f

Download Submit