Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 18:46
General
-
Target
LovelyCraftPistonTrap Win64 v.0.1-175/LovelyCraftPistonTrap_Data/ScriptingAssemblies.json
-
Size
4KB
-
MD5
197b8d2cd994f478f38672be181dddda
-
SHA1
871699cfb1d1ae56c7a7f07077408921dc44d28b
-
SHA256
b224ac0452b9aa6145019da297c7a56938e45271858f5190d17aa5dd566e1bea
-
SHA512
5cd0ec22113aaabfda5bfd34ae8154a368a355f8b1abf3446b67d4e488976a0be48caf572cffc8d5787cc231dddbdd4dfe1ec413d068340efbec489574373c0f
-
SSDEEP
48:YXNAYrKXrjFRlClouNuQGoSfTG/fjTPichHamlhd9bm4FpDe6nf:G0jrlMouNtjHHambm/6nf
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\LovelyCraftPistonTrap Win64 v.0.1-175\LovelyCraftPistonTrap_Data\ScriptingAssemblies.json"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx