Analysis
-
max time kernel
153s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
14-03-2023 13:16
General
-
Target
windows.exe
-
Size
213KB
-
MD5
7fb1c5dfc2605843cec69a6fc4e96576
-
SHA1
b5e591d23a3798b89648033760d3710a403b32be
-
SHA256
330c1d3dd702af11b01ae38ced101e4c4217816e4887e9ebffe2e529cdc857d5
-
SHA512
0c62d01a97d01044a7f4083f2cf6a0e18397bc50cc9f0847bf6da2f604d1d89cd3010d005785077aca2d8249f870f2817a6b4d845235cda55ac5519aee5dc1b7
-
SSDEEP
6144:QPF/ZUebo8fKrnfc6cU2btV0h7FusG/oImYM:IF/ZzRoImYM
Malware Config
Signatures
-
Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
528KB
-
Filesize
324KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.8MB
-
Filesize
76KB
-
Filesize
112KB
-
Filesize
240KB
-
Filesize
604KB
-
Filesize
484KB
-
Filesize
92KB
-
Filesize
44KB
-
Filesize
1.6MB
-
Filesize
280KB
-
Filesize
44KB
-
Filesize
1.2MB
-
Filesize
196KB
-
Filesize
4.0MB
-
Filesize
652KB
-
Filesize
568KB
-
Filesize
172KB
-
Filesize
448KB
-
Filesize
44KB
-
Filesize
40KB
-
Filesize
472KB
-
Filesize
100KB
-
Filesize
10.8MB
-
Filesize
89.5MB
-
Filesize
224KB
-
Filesize
352KB
-
Filesize
316KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
10.8MB
-
Filesize
232KB
-
Filesize
224KB
-
Filesize
92KB
-
Filesize
244KB
-
Filesize
92KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
236KB
-
Filesize
10.7MB
-
Filesize
164KB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB