Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Cracker.dll
windows7-x64
1Cracker.dll
windows10-2004-x64
8Data/Packa...ce.dll
windows7-x64
1Data/Packa...ce.dll
windows10-2004-x64
1Resource.dll
windows7-x64
1Resource.dll
windows10-2004-x64
1Setup.exe
windows7-x64
7Setup.exe
windows10-2004-x64
10libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 15:31
Static task
static1
Behavioral task
behavioral1
Sample
Cracker.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Cracker.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Data/Packaged/Resource.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Data/Packaged/Resource.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Resource.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Resource.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Setup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
libGLESv2.dll
Resource
win10v2004-20240426-en
General
-
Target
Setup.exe
-
Size
608KB
-
MD5
11be050f771a4b60d731464f6db5479d
-
SHA1
e273ebbb5d8aeea9e1e2c5df76da22e40f4231fd
-
SHA256
8d529fe1e7238d741ffe62357dfbf632beb869b7954900d96133cdc290f06790
-
SHA512
9678b5563cf5e7f33b16439768207665c9ef0599dc978ab9cd5b37afe1ddf580c462f7f23ee908b504568e42d11d05d41d3a249161dd08616aaf5e051e8f8455
-
SSDEEP
12288:KCSAVVhuBjUgpVRbX+zPudU8rOGmrsdlipcjgYPrKYlQcN1m6wif7sY4+QumXGPd:KCSA1uqgzRz+zPIU8r10P
Malware Config
Extracted
lumma
https://distincttangyflippan.shop/api
https://macabrecondfucews.shop/api
https://greentastellesqwm.shop/api
https://stickyyummyskiwffe.shop/api
https://sturdyregularrmsnhw.shop/api
https://lamentablegapingkwaq.shop/api
https://innerverdanytiresw.shop/api
https://standingcomperewhitwo.shop/api
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4636 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4636 set thread context of 2840 4636 Setup.exe 85 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85 PID 4636 wrote to memory of 2840 4636 Setup.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵PID:2840
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
437KB
MD544af1103d6ce490f9f7e7d02d72b8b9e
SHA176ba8f9399b8d083f965876fd7e169c33ad641bc
SHA256d156780bbc2ad35d22d00f57b00aa73dd898baea34d1f254ded14778f44bb7ad
SHA512c819a78d357c8ef40fd03b49f1c8608a130581c7ec28bd403ae75ce41d78aa71e312156b0cda8a94df48197bb1aed681501e2767a86ef10bbea968ba0ad989c2