9309cbe621ced13494dd892250ea9ef33716713f316c384ad094b7dbd1ff73a3

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CollapseLoader-1.2.5/collapse/utils/Cheat.py
Size

4KB
MD5

c465aa2e1953aed7c47101317725ddd7
SHA1

9cc53afe1734ea4bf8d0d922627bc5082579dbf3
SHA256

3ee8ff8e7349a16bc701b4deaa482b3401d25498d5955fd30bbd1903aed0755b
SHA512

0acd6c4030ba8c8f4c19abf94afeee3440428b6c8c9f32091f7cb78167472dfabf192ae10928b2b2ac9da813b03025f826dbef3b473a5112e6fea02bddb55de1
SSDEEP

96:Y7NaP00/r97eQ6eBq0lhYew6w6gcVkYTQcE3uPZHJQX:YhF05I0nYewN6gwvTQcE3uPZHM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2612	1908	cmd.exe	29
PID 1908 wrote to memory of 2612	1908	cmd.exe	29
PID 1908 wrote to memory of 2612	1908	cmd.exe	29
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Cheat.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Cheat.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Cheat.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8b58a4391ed1776665865c7efae76e61

SHA1
6d5ec8b2f8928ed1a3f353a1378ddf3287f27652

SHA256
3f16f303ae51998f2af64674c40d9d1d6e85bb8e4949de660be0adc78257a26e

SHA512
153d1d87089b0f412b73fbbdba894a98581f27c9648b567354b39a5f6b91e5824147f4b17abcc55f1e7c4bc0f6ca9ffebe66bc53e89dedb97b21b41c847ec48c

Download Submit