aaf658e5a573d58899bd6219b7a1adb4eca722aebb920f612a105e3a72082eef

Analysis

max time kernel
1562s
max time network
1567s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17-02-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loveware-master/README.md
Size

1KB
MD5

e2282d94c8ebb679b0a5bd1e9e1a5d89
SHA1

cf9dd46fa1fb60d6dd6fc02462d68d79e7c0783d
SHA256

5f6d996edd195dff3392bb949b480b33f85e93136c1a50b768add278d27a135b
SHA512

b824505f7fc466eaaf7849f7f2af471ab99c5fd15954b09d51578236858355b4e3f840b56740bf6e359b43f0fb361b0fe6ce7866d6832d6e5d554085a05d5c5a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.md	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.md\ = "md_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\md_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2872	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2872	AcroRd32.exe
2872	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2848	3028	cmd.exe	29
PID 3028 wrote to memory of 2848	3028	cmd.exe	29
PID 3028 wrote to memory of 2848	3028	cmd.exe	29
PID 2848 wrote to memory of 2872	2848	rundll32.exe	30
PID 2848 wrote to memory of 2872	2848	rundll32.exe	30
PID 2848 wrote to memory of 2872	2848	rundll32.exe	30
PID 2848 wrote to memory of 2872	2848	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Loveware-master\README.md
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Loveware-master\README.md
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Loveware-master\README.md"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f3657bb6cfe8053db8f583c590a715ac

SHA1
7278f35c25f2cf9299c6c325f652b17d4cf24aa1

SHA256
f6abbd55bf4eca824d4a1b7e6b949299eb02069de1861c3eee213318324594ae

SHA512
2c05637e3b39d3915d496d24dd8987e0235eff30bbe3e4e042a7d869476cf12dbad8c3d0a6045c7728466b26127beae38955b24c80eaf6c2835a09dc720045ef

Download Submit