9309cbe621ced13494dd892250ea9ef33716713f316c384ad094b7dbd1ff73a3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-06-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CollapseLoader-1.2.5/collapse/utils/Fabric/FabricCheat.py
Size

3KB
MD5

87ace01372f87810dbdec24859534608
SHA1

928a07ad5f9ed183395593ff827924abe8f352d0
SHA256

06b23eefc32bdfb651ce7e6b1f45f5a9248753e26658e531650c88bbad832e30
SHA512

288a3bb0a0d8f6d0c153bb100266e48cd9ec38784195bdb62d1b86e66056c0bae5ceb00e45ef190714d85d1079ea403fa726b2121e53c966bb87d91a81502c19

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 3056	1044	cmd.exe	29
PID 1044 wrote to memory of 3056	1044	cmd.exe	29
PID 1044 wrote to memory of 3056	1044	cmd.exe	29
PID 3056 wrote to memory of 2684	3056	rundll32.exe	30
PID 3056 wrote to memory of 2684	3056	rundll32.exe	30
PID 3056 wrote to memory of 2684	3056	rundll32.exe	30
PID 3056 wrote to memory of 2684	3056	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Fabric\FabricCheat.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Fabric\FabricCheat.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CollapseLoader-1.2.5\collapse\utils\Fabric\FabricCheat.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
360f4d2c1afa5f8a9480d9ab26404ba4

SHA1
8f3a9f234267e277e7d2240108d91608580150d1

SHA256
8cc4935bd20194e5a4633ff18c0e38a2d6811549f30f9e850248c5f1f0f480df

SHA512
19947d2cf3f6ca528323997c40829867f33f5591d51220eda792a1557a65e333f012dc03ea5cc69c898be072b9a0761811922a899b11233306777dc49e2e21ff

Download Submit