Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1804s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 15:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cheeto.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
cheeto.exe
Resource
win11-20240419-en
windows11-21h2-x64
3 signatures
1800 seconds
General
-
Target
cheeto.exe
-
Size
2.5MB
-
MD5
4752ae9ded1b067272b532fb5fa71532
-
SHA1
21d5d56e2c19ba80e1490ef848e3eea7cb19ce27
-
SHA256
14b464786e4d4a374edbc1145068b183ca91dd49ced7f87852d56bdf85fdd8d6
-
SHA512
2a16fab76366621f8455c6aa991d4d204c20d1b667ee6d39a4e674a1b4b6abd865e36e090ac5508f73a3185a078ff14e30c81461745f7b97decf7f3aa5751708
-
SSDEEP
49152:vGAnxphqIyIc5uvBMbznLoktmx9OTcMw9xvunT6:3xnqbIc6MPnLfmKWv
Malware Config
Extracted
Family
lumma
C2
https://productivelookewr.shop/api
https://tolerateilusidjukl.shop/api
https://shatterbreathepsw.shop/api
https://shortsvelventysjo.shop/api
https://incredibleextedwj.shop/api
https://alcojoldwograpciw.shop/api
https://liabilitynighstjsko.shop/api
https://demonstationfukewko.shop/api
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4000 cheeto.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4000 set thread context of 2756 4000 cheeto.exe 92 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1628 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1628 taskmgr.exe Token: SeSystemProfilePrivilege 1628 taskmgr.exe Token: SeCreateGlobalPrivilege 1628 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe 1628 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92 PID 4000 wrote to memory of 2756 4000 cheeto.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheeto.exe"C:\Users\Admin\AppData\Local\Temp\cheeto.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵PID:2756
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4584 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:4756
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4948 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
414KB
MD5b8ebe7dc8443e833cf322550e92ab5f7
SHA1a444f24639e0bdfa5941ee77bbf1a74ffc1b4c5d
SHA2562c52fbcbfeda65a4c8b17f499ba782b5e282c8f8e94eb7260fc34fa246d1813c
SHA5128c75abb16e0031b143232e54d9e695ad263be0a45269e693125e0cf18bad4b984140dc5fee869b4718c13f5cb51402329be2785a8a8d655bf6ae239228a526bb