9309cbe621ced13494dd892250ea9ef33716713f316c384ad094b7dbd1ff73a3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CollapseLoader-1.2.5/collapse/utils/Cheats.py
Size

529B
MD5

b38983eabafea89bf9ebe060f672ccb8
SHA1

62ae347f2fe138b2d31d28822900b91abac75be8
SHA256

dd7d6a3335b3d1e1219f64fe411ee1151a4fc4e2301fda37c16618e0b822c737
SHA512

459013ecf821d28ec32d0a3881cef3ae102cea15547eb462eaee2d9f65830fd21b28d3ca9058b84bbfe54ad2098999e5355c9e24430f05bd4ec24bf80bad5188

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1256	AcroRd32.exe
1256	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2368	2232	cmd.exe	29
PID 2232 wrote to memory of 2368	2232	cmd.exe	29
PID 2232 wrote to memory of 2368	2232	cmd.exe	29
PID 2368 wrote to memory of 1256	2368	rundll32.exe	30
PID 2368 wrote to memory of 1256	2368	rundll32.exe	30
PID 2368 wrote to memory of 1256	2368	rundll32.exe	30
PID 2368 wrote to memory of 1256	2368	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Cheats.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Cheats.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Cheats.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93079bda086c486bcf3cbb198173bbe2

SHA1
9dc03d9f4ac8eb7b0a31e33b2c30e06a5122a7ba

SHA256
e2b06040de752f13815ee9faf624e6966b54ef5019d6c36a8e17c5e67179082e

SHA512
018f115b08a848a2cdbab23d8a54d0e0c5c1623ad929edcc8bda3606b3814134d9271853512e74a78b6612c589ea0f5e26318236244fa2ed4ee0f62952372ab1

Download Submit