aaf658e5a573d58899bd6219b7a1adb4eca722aebb920f612a105e3a72082eef

Analysis

max time kernel
1561s
max time network
1561s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 15:07

Target

Loveware-master/Loveware/FinalPayload/FinalPayload.exe
Size

280KB
MD5

02b942ad766d717f2d90f6d1c6b69646
SHA1

bddbb63208fc2b777a97b4707321fbfbc096c2cc
SHA256

fbd5ed2986f6dcdfe32fb0a659cb3363c5bb914ab523da589cad645418dc42f3
SHA512

dec11afa04dd01aefe01b8fe31e7705a4232940f0d1b8e1acaa172eff6f2411500f0ed4e60c9c257d1cdbccff51b559375b862df7c724e37f2a9093c2979db20
SSDEEP

3072:ZJVD1zx0HrJvtuKm8wVKQ3+nBgBDlQID3RjfpKYHiTWNLkk24Pmqsuxa5YUJCU8W:nWFvSH5lQ+hjf8YHuWJjkCU855og9

Score

6^/10

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Loveware-master\\Loveware\\FinalPayload\\FinalPayload.exe"	FinalPayload.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	FinalPayload.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
1684	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1684	3032	FinalPayload.exe	28
PID 3032 wrote to memory of 1684	3032	FinalPayload.exe	28
PID 3032 wrote to memory of 1684	3032	FinalPayload.exe	28
PID 3032 wrote to memory of 1684	3032	FinalPayload.exe	28

C:\Users\Admin\AppData\Local\Temp\Loveware-master\Loveware\FinalPayload\FinalPayload.exe
"C:\Users\Admin\AppData\Local\Temp\Loveware-master\Loveware\FinalPayload\FinalPayload.exe"
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\schtasks.exe
  schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\Loveware-master\Loveware\FinalPayload\FinalPayload.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1684