Analysis
-
max time kernel
38s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 23:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
lnjector.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
-
Target
lnjector.exe
-
Size
146.9MB
-
MD5
dafbb6d70ba2780bdc0c83ff7e5b4ad5
-
SHA1
35038e11db04eb355ae0ded47aa080757a590820
-
SHA256
08329d73b4f63b765278316cd979171012b4426ff75527da61b1443263b487bf
-
SHA512
9de7bfa5dfc6d64b813e8af9667612493f3fe3dea35c42d32ce833ab31015fedfa04635d8852be0e63a84846e034066fec13148072c0369992e570af9c54c529
-
SSDEEP
12288:Qd7i4jrv149y+q3eUn8N7unsFy0QB1Avt7G3c/pFj2TXHgCl2:+ru4TGYHA
Malware Config
Extracted
Family
lumma
C2
https://assumptionflattyou.shop/api
https://technologyenterdo.shop/api
https://detectordiscusser.shop/api
https://turkeyunlikelyofw.shop/api
https://associationokeo.shop/api
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 924 taskmgr.exe Token: SeSystemProfilePrivilege 924 taskmgr.exe Token: SeCreateGlobalPrivilege 924 taskmgr.exe Token: 33 924 taskmgr.exe Token: SeIncBasePriorityPrivilege 924 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe -
Suspicious use of SendNotifyMessage 60 IoCs
pid Process 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe 924 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lnjector.exe"C:\Users\Admin\AppData\Local\Temp\lnjector.exe"1⤵PID:1712
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:924