Analysis
-
max time kernel
152s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe
-
Size
228KB
-
MD5
6dd4f6fc9408bda3ab46f40236652fc9
-
SHA1
b814e6375f343c3ed2193a8d1b927ebdc09ced35
-
SHA256
397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1
-
SHA512
8558fcd6b8785a803b079be2f2a02739730a7cf64a6da8d6ce88cc73ea89d008f0a015bb4966baff727b2f365f8f71b457b56cabeb0147be7806843aa8f397b0
-
SSDEEP
6144:hGtFwzWQTi2+OMcppIRW30d+h8wZ2Uf/T11cradKtvr1K/fObT/bGipKgJJeZ4c7:OFwrKOMcppIRW3M+hwUf/Z1craduvr1K
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" looveiz.exe -
Executes dropped EXE 1 IoCs
pid Process 1156 looveiz.exe -
Loads dropped DLL 2 IoCs
pid Process 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /d" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /H" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /W" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /G" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /h" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /z" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /L" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /K" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /C" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /e" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /B" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /R" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /Y" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /r" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /N" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /p" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /u" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /U" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /a" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /j" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /n" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /c" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /D" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /k" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /t" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /x" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /g" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /O" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /X" looveiz.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /f" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /I" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /P" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /y" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /M" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /A" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /V" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /o" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /S" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /J" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /i" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /q" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /Z" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /e" 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /E" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /l" looveiz.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /w" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /T" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /v" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /m" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /Q" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /b" looveiz.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\looveiz = "C:\\Users\\Admin\\looveiz.exe /F" looveiz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe 1156 looveiz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 1156 looveiz.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 856 wrote to memory of 1156 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 26 PID 856 wrote to memory of 1156 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 26 PID 856 wrote to memory of 1156 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 26 PID 856 wrote to memory of 1156 856 397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe"C:\Users\Admin\AppData\Local\Temp\397bf70b55224927505a71070669dad2190d4a897e0d9852c769927d2b77ffd1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\looveiz.exe"C:\Users\Admin\looveiz.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5751990c2a09798e3c3796fd3603cdd1c
SHA1d8f721931ac553929967eaa10b3b96a57120a5d0
SHA25693952b27d0547c6686a332cd70cf115fca9d2d065770d31eb33be7cb7365cf6f
SHA512af6fba31b46dc790061003a11481c3049e61bf8952fc5bae4432a5ff4423081950f66fe06cc6419eec432f83601e6bc0f727a39c1e22c2b6e5d7e7103ed2ef6e
-
Filesize
228KB
MD5751990c2a09798e3c3796fd3603cdd1c
SHA1d8f721931ac553929967eaa10b3b96a57120a5d0
SHA25693952b27d0547c6686a332cd70cf115fca9d2d065770d31eb33be7cb7365cf6f
SHA512af6fba31b46dc790061003a11481c3049e61bf8952fc5bae4432a5ff4423081950f66fe06cc6419eec432f83601e6bc0f727a39c1e22c2b6e5d7e7103ed2ef6e
-
Filesize
228KB
MD5751990c2a09798e3c3796fd3603cdd1c
SHA1d8f721931ac553929967eaa10b3b96a57120a5d0
SHA25693952b27d0547c6686a332cd70cf115fca9d2d065770d31eb33be7cb7365cf6f
SHA512af6fba31b46dc790061003a11481c3049e61bf8952fc5bae4432a5ff4423081950f66fe06cc6419eec432f83601e6bc0f727a39c1e22c2b6e5d7e7103ed2ef6e
-
Filesize
228KB
MD5751990c2a09798e3c3796fd3603cdd1c
SHA1d8f721931ac553929967eaa10b3b96a57120a5d0
SHA25693952b27d0547c6686a332cd70cf115fca9d2d065770d31eb33be7cb7365cf6f
SHA512af6fba31b46dc790061003a11481c3049e61bf8952fc5bae4432a5ff4423081950f66fe06cc6419eec432f83601e6bc0f727a39c1e22c2b6e5d7e7103ed2ef6e