Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\MagnetRAMCapture] 'ImagePath' = '%TEMP%\_MEI10882\MRC8DEC.tmp'
Creates the following services
- 'MagnetRAMCapture' %TEMP%\_MEI10882\MRC8DEC.tmp
Modifies file system
Creates the following files
- %TEMP%\_mei10882\crypto\cipher\_arc4.pyd
- %TEMP%\_mei10882\dump\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\dump\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\dump\__pycache__\dump_plugin.cpython-34.pyc
- %TEMP%\_mei10882\dump\__pycache__\dump_plugin.cpython-39.pyc
- %TEMP%\_mei10882\dump\__pycache__\mbr.cpython-34.pyc
- %TEMP%\_mei10882\_xmllib.pyd
- %TEMP%\_mei10882\base_library.zip
- %TEMP%\_mei10882\dump\__pycache__\mbr.cpython-39.pyc
- %TEMP%\_mei10882\evt\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\evt\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\evt\__pycache__\evt_plugin.cpython-34.pyc
- %TEMP%\_mei10882\evt\__pycache__\evt_plugin.cpython-39.pyc
- %TEMP%\_mei10882\evt\evt_plugin.py
- %TEMP%\_mei10882\dump\dump_plugin.py
- %TEMP%\_mei10882\dump\mbr.py
- %TEMP%\_mei10882\filecatcher\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\filecatcher\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\_x86\verifier.dll
- %TEMP%\_mei10882\_analyzemft\mftutils.py
- %TEMP%\_mei10882\_x64\7z.dll
- %TEMP%\_mei10882\_x64\7z_old.dll
- %TEMP%\_mei10882\_x64\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\_x86\zipper.dll
- %TEMP%\_mei10882\_analyzemft\__pycache__\mftutils.cpython-34.pyc
- %TEMP%\_mei10882\_x86\zipper_old.dll
- %TEMP%\_mei10882\_x64\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\_x86\7z.dll
- %TEMP%\_mei10882\_x86\7z_old.dll
- %TEMP%\_mei10882\_x86\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\_x86\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\_x64\verifier.dll
- %TEMP%\_mei10882\_x64\zipper.dll
- %TEMP%\_mei10882\_x64\zipper_old.dll
- %TEMP%\_mei10882\crypto\util\_strxor.pyd
- %TEMP%\_mei10882\filecatcher\__pycache__\filecatcher_plugin.cpython-34.pyc
- %TEMP%\_mei10882\utils\__pycache__\zipper.cpython-34.pyc
- %TEMP%\_mei10882\utils\file_extractor.py
- %TEMP%\_mei10882\utils\utils.py
- %TEMP%\_mei10882\utils\vss.py
- %TEMP%\_mei10882\utils\zip_io.py
- %TEMP%\_mei10882\utils\__pycache__\vss.cpython-39.pyc
- %TEMP%\_mei10882\utils\zipper.py
- %TEMP%\_mei10882\utils\__pycache__\zipper.cpython-39.pyc
- %TEMP%\_mei10882\win32mutex.pyd
- %TEMP%\tmpo5o5amnr\gen_py\__init__.py
- %TEMP%\tmpo5o5amnr\gen_py\dicts.dat
- <Current directory>\output\fsnizomldk_2023-02-02_135339\fastir.log
- %TEMP%\_mei10882\mrc8dec.tmp
- %TEMP%\_mei10882\win32memory.pyd
- %TEMP%\_mei10882\utils\__pycache__\vss.cpython-34.pyc
- %TEMP%\z8okwtdu
- %TEMP%\_mei10882\utils\__pycache__\utils.cpython-39.pyc
- %TEMP%\_mei10882\utils\__pycache__\utils.cpython-34.pyc
- %TEMP%\_mei10882\filecatcher\filecatcher_plugin.py
- %TEMP%\_mei10882\filecatcher\modules\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\filecatcher\modules\__pycache__\intel.cpython-34.pyc
- %TEMP%\_mei10882\filecatcher\modules\__pycache__\intel.cpython-39.pyc
- %TEMP%\_mei10882\filecatcher\modules\intel.py
- %TEMP%\_mei10882\health\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\health\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\filecatcher\modules\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\health\__pycache__\health_plugin.cpython-34.pyc
- %TEMP%\_mei10882\memory\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\utils\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\utils\__pycache__\__init__.cpython-39.pyc
- %TEMP%\_mei10882\utils\__pycache__\file_extractor.cpython-34.pyc
- %TEMP%\_mei10882\utils\__pycache__\file_extractor.cpython-39.pyc
- %TEMP%\_mei10882\_analyzemft\__pycache__\mftsession.cpython-34.pyc
- %TEMP%\_mei10882\health\health_plugin.py
- %TEMP%\_mei10882\_analyzemft\mftsession.py
- %TEMP%\_mei10882\_analyzemft\__pycache__\__init__.cpython-34.pyc
- %TEMP%\_mei10882\include\pyconfig.h
- %TEMP%\_mei10882\yara.pyd
- %TEMP%\_mei10882\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei10882\crypto\hash\_sha1.pyd
- %TEMP%\_mei10882\crypto\hash\_sha224.pyd
- %TEMP%\_mei10882\crypto\hash\_sha256.pyd
- %TEMP%\_mei10882\crypto\hash\_md2.pyd
- %TEMP%\_mei10882\crypto\hash\_blake2b.pyd
- %TEMP%\_mei10882\crypto\hash\_md5.pyd
- %TEMP%\_mei10882\crypto\hash\_sha384.pyd
- %TEMP%\_mei10882\crypto\hash\_keccak.pyd
- %TEMP%\_mei10882\crypto\hash\_poly1305.pyd
- %TEMP%\_mei10882\crypto\math\_modexp.pyd
- %TEMP%\_mei10882\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei10882\crypto\hash\_sha512.pyd
- %TEMP%\_mei10882\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei10882\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei10882\crypto\hash\_blake2s.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei10882\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei10882\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei10882\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei10882\crypto\cipher\_raw_cfb.pyd
- %WINDIR%\temp\udd91e2.tmp
- %TEMP%\_mei10882\filecatcher\__pycache__\filecatcher_plugin.cpython-39.pyc
- %TEMP%\_mei10882\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei10882\_analyzemft\mft.pyd
- %TEMP%\_mei10882\unicodedata.pyd
- %TEMP%\_mei10882\win32api.pyd
- %TEMP%\_mei10882\win32clipboard.pyd
- %TEMP%\_mei10882\win32evtlog.pyd
- %TEMP%\_mei10882\pywintypes34.dll
- %TEMP%\_mei10882\win32file.pyd
- %TEMP%\_mei10882\sihost_x64.exe.manifest
- %TEMP%\_mei10882\win32security.pyd
- %TEMP%\_mei10882\win32trace.pyd
- %TEMP%\_mei10882\win32ui.pyd
- %TEMP%\_mei10882\win32utils.pyd
- %TEMP%\_mei10882\win32wnet.pyd
- %TEMP%\_mei10882\win32process.pyd
- %TEMP%\_mei10882\crypto\hash\_md4.pyd
- %TEMP%\_mei10882\win32service.pyd
- %TEMP%\_mei10882\select.pyd
- %TEMP%\_mei10882\pythoncom34.dll
- %TEMP%\_mei10882\python34.dll
- %TEMP%\_mei10882\_bz2.pyd
- %TEMP%\_mei10882\_ctypes.pyd
- %TEMP%\_mei10882\_elementtree.pyd
- %TEMP%\_mei10882\_hashlib.pyd
- %TEMP%\_mei10882\_lzma.pyd
- %TEMP%\_mei10882\msvcr100.dll
- %TEMP%\_mei10882\_multiprocessing.pyd
- %TEMP%\_mei10882\_ssl.pyd
- %TEMP%\_mei10882\_win32sysloader.pyd
- %TEMP%\_mei10882\distorm3.dll
- %TEMP%\_mei10882\memory\memory_plugin.pyd
- %TEMP%\_mei10882\mfc100u.dll
- %TEMP%\_mei10882\psutil\_psutil_windows.pyd
- %TEMP%\_mei10882\_socket.pyd
- %TEMP%\_mei10882\pyexpat.pyd
- %TEMP%\_mei10882\mrc.exe
- <Current directory>\output\fsnizomldk_2023-02-02_135339\fsnizomldk_memdump.raw
Deletes the following files
- %TEMP%\z8okwtdu
- %WINDIR%\temp\udd91e2.tmp
- %TEMP%\_mei10882\mrc8dec.tmp
Miscellaneous
Creates and executes the following
- '%TEMP%\_mei10882\mrc.exe' /accepteula /silent /go output\fsnizomldk_2023-02-02_135339\\fsnizomldk_memdump.raw
