Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7Loveware-master.zip
windows7-x64
1Loveware-m...ort.md
windows7-x64
3Loveware-m...gs.yml
windows7-x64
3Loveware-m...UCT.md
windows7-x64
3Loveware-m...ING.md
windows7-x64
3Loveware-m...er.jpg
windows7-x64
3Loveware-m...er.exe
windows7-x64
7Loveware-m...4).exe
windows7-x64
7Loveware-m...gs.ini
windows7-x64
1Loveware-m...er.png
windows7-x64
3Loveware-m...re.ico
windows7-x64
3Loveware-m...re.png
windows7-x64
3Loveware-m...ki.png
windows7-x64
3Loveware-m...ar.png
windows7-x64
3Loveware-m...ICENSE
windows7-x64
1Loveware-m...ON.txt
windows7-x64
1Loveware-m...ad.exe
windows7-x64
6Loveware-m...ME.txt
windows7-x64
1Loveware-m...re.bat
windows7-x64
4Loveware-m...kspace
windows7-x64
3Loveware-m...re.ico
windows7-x64
3Loveware-m...DME.md
windows7-x64
3Loveware-m...ig.yml
windows7-x64
3Analysis
-
max time kernel
1564s -
max time network
1567s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 15:07
Behavioral task
behavioral1
Sample
Loveware-master.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Loveware-master/.github/ISSUE_TEMPLATE/bug_report.md
Resource
win7-20231215-en
Behavioral task
behavioral3
Sample
Loveware-master/.github/workflows/greetings.yml
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Loveware-master/CODE_OF_CONDUCT.md
Resource
win7-20231215-en
Behavioral task
behavioral5
Sample
Loveware-master/CONTRIBUTING.md
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Loveware-master/Extras/Banner.jpg
Resource
win7-20231215-en
Behavioral task
behavioral7
Sample
Loveware-master/Extras/CONVERTER/Bat_To_Exe_Converter.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Loveware-master/Extras/CONVERTER/Bat_To_Exe_Converter_(x64).exe
Resource
win7-20231129-en
Behavioral task
behavioral9
Sample
Loveware-master/Extras/CONVERTER/settings.ini
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Loveware-master/Extras/Footer.png
Resource
win7-20231215-en
Behavioral task
behavioral11
Sample
Loveware-master/Extras/Loveware.ico
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Loveware-master/Extras/Loveware.png
Resource
win7-20231215-en
Behavioral task
behavioral13
Sample
Loveware-master/Extras/PayloadsWiki.png
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Loveware-master/Extras/SideBar.png
Resource
win7-20231215-en
Behavioral task
behavioral15
Sample
Loveware-master/LICENSE
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Loveware-master/Loveware/DOCUMENTATION.txt
Resource
win7-20231215-en
Behavioral task
behavioral17
Sample
Loveware-master/Loveware/FinalPayload/FinalPayload.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Loveware-master/Loveware/FinalPayload/README.txt
Resource
win7-20231129-en
Behavioral task
behavioral19
Sample
Loveware-master/Loveware/Loveware.bat
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
Loveware-master/Loveware/Loveware.code-workspace
Resource
win7-20231215-en
Behavioral task
behavioral21
Sample
Loveware-master/Loveware/Loveware.ico
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
Loveware-master/README.md
Resource
win7-20231215-en
Behavioral task
behavioral23
Sample
Loveware-master/_config.yml
Resource
win7-20231129-en
General
-
Target
Loveware-master/CODE_OF_CONDUCT.md
-
Size
3KB
-
MD5
52f1087307e94d018a1caa40d7492904
-
SHA1
3d6a8dfebd3f606032eb505a91ae7b052f5aa227
-
SHA256
7f77267df005fe6de94a5562823cec7ccb5c470d80731b9939a1cb4f3f1638f1
-
SHA512
fc5c981f9eadc44e8fc1022f5774063541184eef64a199562e25ba4d5591de56c0ba04c18999f421a1a924d03e9f431f9088f25fbe7debae0fe4310bea494565
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.md rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\md_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\md_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\md_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2696 AcroRd32.exe 2696 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1212 wrote to memory of 2676 1212 cmd.exe 29 PID 1212 wrote to memory of 2676 1212 cmd.exe 29 PID 1212 wrote to memory of 2676 1212 cmd.exe 29 PID 2676 wrote to memory of 2696 2676 rundll32.exe 30 PID 2676 wrote to memory of 2696 2676 rundll32.exe 30 PID 2676 wrote to memory of 2696 2676 rundll32.exe 30 PID 2676 wrote to memory of 2696 2676 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Loveware-master\CODE_OF_CONDUCT.md1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Loveware-master\CODE_OF_CONDUCT.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Loveware-master\CODE_OF_CONDUCT.md"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2696
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD55f81cf7ebd3d65827bb9332d2816597e
SHA150ef8e34b8bf0e2c7867592110919ef8b167f5d7
SHA256561ab2d50156d0c2c6c2d85904eb4e00c0b389065e3a39b0058012c2dbca5da4
SHA5127bc91b8317507f3f35780703b993f0778305ef6d5dc254a69d08fb25925f1752d89a94721f803b2ed32155297c0c5cd567a83f448f98441c94ef7c138ceb216b