4355ff63b7d79c659fa159a25f8f1d5d77ae0c2816f1e6e12241ef3e1d3a2443

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-12-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LovelyCraftPistonTrap Win64 v.0.1-175/LovelyCraftPistonTrap_Data/StreamingAssets/aa/StandaloneWindows64/fonts_assets_all.bundle
Size

1.4MB
MD5

39c8becd86ea19acf8e902f5f2540ef6
SHA1

8500de0056db12380ca0b6b06662788a89ddc856
SHA256

a8695523177f9613e04085df60ac0f3421143a1e1597cf7817ec79a83e095f83
SHA512

b98fae45c31980c6601631ab5d72b3c84d4e4f4f15c40866436e93fb4ad9b904394a296293a3e9278976fdf0e90acbb5ec4f9bd4d28e0356c3dcdd1f3d983f01
SSDEEP

24576:OJ1loLVknWMV0uNoXFBhvVLQ3YVyb4N4Z7/7DkZedzRE2ILTATpf0N1C:41Kq3ILhKAB4Z7/uClJeg

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2892	2720	cmd.exe	31
PID 2720 wrote to memory of 2892	2720	cmd.exe	31
PID 2720 wrote to memory of 2892	2720	cmd.exe	31
PID 2892 wrote to memory of 2576	2892	rundll32.exe	32
PID 2892 wrote to memory of 2576	2892	rundll32.exe	32
PID 2892 wrote to memory of 2576	2892	rundll32.exe	32
PID 2892 wrote to memory of 2576	2892	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\LovelyCraftPistonTrap Win64 v.0.1-175\LovelyCraftPistonTrap_Data\StreamingAssets\aa\StandaloneWindows64\fonts_assets_all.bundle"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\LovelyCraftPistonTrap Win64 v.0.1-175\LovelyCraftPistonTrap_Data\StreamingAssets\aa\StandaloneWindows64\fonts_assets_all.bundle
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LovelyCraftPistonTrap Win64 v.0.1-175\LovelyCraftPistonTrap_Data\StreamingAssets\aa\StandaloneWindows64\fonts_assets_all.bundle"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
df6a17bf412128795769b27f03162c59

SHA1
ce8420c48db7b20037891f787d8a5c237cde0370

SHA256
dfe4e73298ab53dddc0eaa71e75e1482642175184c9e42b63e47eecd7824c198

SHA512
b69255ea87ed310b2f314e79ae68881c9486610ecbcd42e1bd7b0a4ff8ea78864ed1467fc033a9befed8fe97cb2e9bca19de2ab190eabe9d798a727774880ad5

Download Submit