Analysis
- max time kernel
52s - max time network
41s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system - submitted
26/02/2024, 17:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Laun4er.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
General
- Target Laun4er.exe
- Size 14.3MB
- Sample240226-vrvmrsbd73
- SHA256 d0dc4378207932096b56182f38785094f42dec36ebd932dc16fec13682e1cb41
- MD5 3aeb3d1f47fcd73aaf558e03e03ac682
- SHA1 7f173b5d742a20ef0cae9ae2928db9c33ec88362
- SHA512 7911ee1fc66b67123a5dc6d183f5b8d324e497866fa306abc344080bc59cd53fd7c0defc40af0794e58c9519c16332a294667c7b2a22e730e97e4f0a3ce991bd
- SSDEEP 12288:wdmOfSrG1BzYdHGdqOiEuroGZYiC46hkDo2GQlL:9oYG1BzYdHGdqTEfFc6QojQlL
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
lumma
C2
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4580 set thread context of 2912 4580 Laun4er.exe 89 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe - Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3912 taskmgr.exe Token: SeSystemProfilePrivilege 3912 taskmgr.exe Token: SeCreateGlobalPrivilege 3912 taskmgr.exe Token: 33 3912 taskmgr.exe Token: SeIncBasePriorityPrivilege 3912 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe 3912 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3912 taskmgr.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89 PID 4580 wrote to memory of 2912 4580 Laun4er.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Laun4er.exe"C:\Users\Admin\AppData\Local\Temp\Laun4er.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2912
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3912
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1696