Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 14:04
Static task
static1
Behavioral task
behavioral1
Sample
ErikGlorious_crypted_EASY.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
ErikGlorious_crypted_EASY.exe
Resource
win11-20240508-en
General
-
Target
ErikGlorious_crypted_EASY.exe
-
Size
394KB
-
MD5
f758008b7884936d9b2a89d14c317b18
-
SHA1
336c1e0d7ad5d58dbb4184710ed399af4494afde
-
SHA256
341e941ba420f41c4d5887b2f5f19084bd0dc7addf3e3c694f79ebea2fcad370
-
SHA512
133d8d0443f94efd806555c57607d88a0c419f508333f827dd856e1829f58c70efcd6a7df2421ca0fbff1a582feec820210e4dff757dacd24c91f01ba3b65a1e
-
SSDEEP
12288:NF0ceA3g4vjEgKVpBfquOciBeGJr804EpkHeBOVOXRE0NxLFRHMA5X7UUghFx7X0:NJwojIVpxAci
Malware Config
Extracted
lumma
https://museumtespaceorsp.shop/api
https://buttockdecarderwiso.shop/api
https://averageaattractiionsl.shop/api
https://femininiespywageg.shop/api
https://employhabragaomlsp.shop/api
https://stalfbaclcalorieeis.shop/api
https://civilianurinedtsraov.shop/api
https://roomabolishsnifftwk.shop/api
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
ErikGlorious_crypted_EASY.exepid process 3748 ErikGlorious_crypted_EASY.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ErikGlorious_crypted_EASY.exedescription pid process target process PID 3748 set thread context of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
chrome.exepid process 3844 chrome.exe 3844 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
chrome.exepid process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe Token: SeShutdownPrivilege 3844 chrome.exe Token: SeCreatePagefilePrivilege 3844 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
Processes:
chrome.exepid process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe 3844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ErikGlorious_crypted_EASY.exechrome.exedescription pid process target process PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3748 wrote to memory of 2076 3748 ErikGlorious_crypted_EASY.exe aspnet_regiis.exe PID 3844 wrote to memory of 1428 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1428 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 4656 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1916 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1916 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe PID 3844 wrote to memory of 1504 3844 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ErikGlorious_crypted_EASY.exe"C:\Users\Admin\AppData\Local\Temp\ErikGlorious_crypted_EASY.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde57aab58,0x7ffde57aab68,0x7ffde57aab782⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:22⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:82⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2248 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:82⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:12⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:12⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:12⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4116 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:82⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4536 --field-trial-handle=1744,i,4273423360348859325,4818982887726508436,131072 /prefetch:82⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
739B
MD51bb1a40d96a0978a0f103074742c3ed2
SHA15c6023a7e0bcd2399f2defe0f4b5bb770137e3d1
SHA2561db0b44309d8a83fdb6026d7ddb35091d05c27976f26abaf9a10163d92b28c2d
SHA512847944445ec0eadcb086a86831eccb6bfacc163d2d018924a67d198c10ec0503cfd18262d13f47b19fcbe50453a1a578d975011d484ea715e17c59a1b9009474
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
189B
MD54e1b7414153375e4272b71d6c9b643f8
SHA144a62edc68320b0246dbc93bc1fb2b9662a73a95
SHA25642219a512e13879a2435094d4f069e209e7f8f2260ec2278d0f947533f30cb99
SHA512b48ba99ab4a359bfedbddf37d6eb96429dc241ec77dc9e2a98ab05fc9a711351d7c36d507db41e5400a1f0bdee340f7c9caec83632e7bb409fad66931fc7059d
-
Filesize
6KB
MD577348866b1ddf2ce76bd33a21a13b691
SHA1acbb8c2353949549c90ab6bfabd0eeced8e74006
SHA25640e022b43b0a05f9358248b3cc2e0bc184b4c6b0df1e378b2299c30a74f84fb1
SHA51203c244d6170ab6bf811e8c6139a847f280d074a503db583c127f6d572f0505d93cf5453aac354872c6e3f9041efc58cc1f5a9eab295380bf2085b3b8109da1ba
-
Filesize
255KB
MD526ec48ba1499d43c78433f527e723d58
SHA1f94257b71ab6a86b5c315e74893327bdd76febda
SHA2566af29608ab825c46a8194a9e4e5eea46dfb1110dabc3ae10af1063d6e1908213
SHA51250e91eb9569fb8279276344524e1249699631dd97e627530e5419f2a1f75bbc84a67696bcb808345fc0d89d5633d8d7b6e36d4e6509bf9c6d79879f070e902e8
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
403KB
MD5be271ff6a2ef27c8e8206400281366a6
SHA1c84ce338321d94eb53f2a73c8ef76702ddc1e0d1
SHA256af8734ac99fc5e32ab090ee1a4003383ceb14c8c076879ce6933cda3389f73ee
SHA51204d96e3b1f23aef43f5ea3e6637173a80e1db63b5de16346d3e9ae84b6e440810021d04c134b445cc3d0c59a78251986f9c9ec6e203e6395052442aa2cb3d44b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e