aaf658e5a573d58899bd6219b7a1adb4eca722aebb920f612a105e3a72082eef

Analysis

max time kernel
1563s
max time network
1564s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loveware-master/Extras/Banner.jpg
Size

387KB
MD5

6306719780a26679775c68fba1b8d7f8
SHA1

401a703a1e165a4294548f89f964e52e08926f6c
SHA256

d436a3b51b9999f3dc5f299d9b8b3647b8f065a8cca18d9104678f4c2e5b1f16
SHA512

439509f08b0cba866f1a1983197eba718421370af19c5145f6079b1b64479d8e84d0cf313fbd616968fe7f6e253863cc76edec23e14779c9bc2973de72aeacb4
SSDEEP

12288:7lZF/QTHHwxvXCmH3zQNSuSOOEERKq2ISK:7lZFITnwVymjQUuSOeMPK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	rundll32.exe

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\Loveware-master\Extras\Banner.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1992-1-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download