Overview
overview
7Static
static
7Loveware-master.zip
windows7-x64
1Loveware-m...ort.md
windows7-x64
3Loveware-m...gs.yml
windows7-x64
3Loveware-m...UCT.md
windows7-x64
3Loveware-m...ING.md
windows7-x64
3Loveware-m...er.jpg
windows7-x64
3Loveware-m...er.exe
windows7-x64
7Loveware-m...4).exe
windows7-x64
7Loveware-m...gs.ini
windows7-x64
1Loveware-m...er.png
windows7-x64
3Loveware-m...re.ico
windows7-x64
3Loveware-m...re.png
windows7-x64
3Loveware-m...ki.png
windows7-x64
3Loveware-m...ar.png
windows7-x64
3Loveware-m...ICENSE
windows7-x64
1Loveware-m...ON.txt
windows7-x64
1Loveware-m...ad.exe
windows7-x64
6Loveware-m...ME.txt
windows7-x64
1Loveware-m...re.bat
windows7-x64
4Loveware-m...kspace
windows7-x64
3Loveware-m...re.ico
windows7-x64
3Loveware-m...DME.md
windows7-x64
3Loveware-m...ig.yml
windows7-x64
3Analysis
-
max time kernel
1563s -
max time network
1564s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
17/02/2024, 15:07
Behavioral task
behavioral1
Sample
Loveware-master.zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Loveware-master/.github/ISSUE_TEMPLATE/bug_report.md
Resource
win7-20231215-en
Behavioral task
behavioral3
Sample
Loveware-master/.github/workflows/greetings.yml
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Loveware-master/CODE_OF_CONDUCT.md
Resource
win7-20231215-en
Behavioral task
behavioral5
Sample
Loveware-master/CONTRIBUTING.md
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
Loveware-master/Extras/Banner.jpg
Resource
win7-20231215-en
Behavioral task
behavioral7
Sample
Loveware-master/Extras/CONVERTER/Bat_To_Exe_Converter.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Loveware-master/Extras/CONVERTER/Bat_To_Exe_Converter_(x64).exe
Resource
win7-20231129-en
Behavioral task
behavioral9
Sample
Loveware-master/Extras/CONVERTER/settings.ini
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
Loveware-master/Extras/Footer.png
Resource
win7-20231215-en
Behavioral task
behavioral11
Sample
Loveware-master/Extras/Loveware.ico
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Loveware-master/Extras/Loveware.png
Resource
win7-20231215-en
Behavioral task
behavioral13
Sample
Loveware-master/Extras/PayloadsWiki.png
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Loveware-master/Extras/SideBar.png
Resource
win7-20231215-en
Behavioral task
behavioral15
Sample
Loveware-master/LICENSE
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
Loveware-master/Loveware/DOCUMENTATION.txt
Resource
win7-20231215-en
Behavioral task
behavioral17
Sample
Loveware-master/Loveware/FinalPayload/FinalPayload.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
Loveware-master/Loveware/FinalPayload/README.txt
Resource
win7-20231129-en
Behavioral task
behavioral19
Sample
Loveware-master/Loveware/Loveware.bat
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
Loveware-master/Loveware/Loveware.code-workspace
Resource
win7-20231215-en
Behavioral task
behavioral21
Sample
Loveware-master/Loveware/Loveware.ico
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
Loveware-master/README.md
Resource
win7-20231215-en
Behavioral task
behavioral23
Sample
Loveware-master/_config.yml
Resource
win7-20231129-en
General
-
Target
Loveware-master/CONTRIBUTING.md
-
Size
805B
-
MD5
c542d0eb90a12139c347adcb11456354
-
SHA1
e84bad6e6d2b4b95bc311c9a84844ab3eacef780
-
SHA256
de5134e8f31d3e488e725bc4a80dd7f560273672b46a0c5b8294df8d768639d1
-
SHA512
3bb75fd58831d550dad487ca74930d7f28459f76737236ae08f64808ba25ba8f8369bb21220d8ae2386f502fe0afbc6f12be65a764a36414d6b0d4d17e17cdfb
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.md rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.md\ = "md_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\md_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\md_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\md_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\md_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\md_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\md_auto_file\shell rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2744 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2744 AcroRd32.exe 2744 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2572 2028 cmd.exe 27 PID 2028 wrote to memory of 2572 2028 cmd.exe 27 PID 2028 wrote to memory of 2572 2028 cmd.exe 27 PID 2572 wrote to memory of 2744 2572 rundll32.exe 30 PID 2572 wrote to memory of 2744 2572 rundll32.exe 30 PID 2572 wrote to memory of 2744 2572 rundll32.exe 30 PID 2572 wrote to memory of 2744 2572 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Loveware-master\CONTRIBUTING.md1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Loveware-master\CONTRIBUTING.md2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Loveware-master\CONTRIBUTING.md"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD584d1f16d2d4b90747d059d2af03ed80e
SHA13479955aa1e8f73b4768e704c22c604f1f43eda4
SHA256561213a7cd6543421c869e78d33c0ba09874ea0f8d3ab590da029822bcc6fb9f
SHA512562830950f177fabaeae33aa6e7cad6fbe0b65f81e571272a857efbe44273c20527d00286a5d3ef69bf96bd462048ca5393b704dc495eccd798936c216a2d3c3