aaf658e5a573d58899bd6219b7a1adb4eca722aebb920f612a105e3a72082eef

Analysis

max time kernel
1797s
max time network
1815s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loveware-master/.github/workflows/greetings.yml
Size

582B
MD5

936db8cade6e27a9adf8056f64ff40f4
SHA1

a3cfe18d40316f715bd0cb07855cc9a8d81c7733
SHA256

9d2b9ce7f456b2293780d6f31ab19f9a84178dba32eb6cf44331bd8f05b345fb
SHA512

002f4bc7ddddbe56f5fffcad5d1c924bd4e692dfe052d8a430fad1b4ed6e9bf61cd3749ae045f54ea17fcd0361576ce5c4dd092a14fb89d87718524cfbaa442a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\yml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\yml_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\yml_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.yml	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.yml\ = "yml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\yml_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\yml_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\yml_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2768	AcroRd32.exe
2768	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2968	2192	cmd.exe	29
PID 2192 wrote to memory of 2968	2192	cmd.exe	29
PID 2192 wrote to memory of 2968	2192	cmd.exe	29
PID 2968 wrote to memory of 2768	2968	rundll32.exe	30
PID 2968 wrote to memory of 2768	2968	rundll32.exe	30
PID 2968 wrote to memory of 2768	2968	rundll32.exe	30
PID 2968 wrote to memory of 2768	2968	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Loveware-master\.github\workflows\greetings.yml
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Loveware-master\.github\workflows\greetings.yml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Loveware-master\.github\workflows\greetings.yml"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2bc1fa1a866868301b56e8588bd32807

SHA1
c9ba45a6a5364d2052bd619c0caf7d1f93a45941

SHA256
f4734f521fe09c08098655bdec4988a3a870de2a0a015e909768fd212d9defb0

SHA512
59e1dbe91997688e1a064e0f2e827477166d5a63853c5d55d00104984b0d8b836358f520cc02a7939a142766d58b91b4874cad8d2123c5017b32945ccb976291

Download Submit