Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 04:05

General

  • Target

    $R0/Uninstall Lunar Client.exe

  • Size

    179KB

  • MD5

    d8467036b71c4b617ba5c2d90a3c8f34

  • SHA1

    af9542cc0c2962ef73190d6f85d43d0202130529

  • SHA256

    970ea7020a05ad79d9d89bc584553452abf2745a7e47be6792578eb3e41fb382

  • SHA512

    693070ec8f10ee7cab7f4ed8758723d8574a847fd8f408e5d0c445567296bbbe437d36be8ac8acd671f40c4d4b0a67b0e6fafcee1f0f6ae0dcf0cd788f0802c6

  • SSDEEP

    3072:Kn77v00hEoDEtau24lkW6Dx/XItjLSTtWIDlXiGzo7Qqt7iv1/aH2tvhOEA1RJC9:K740ImskW6V4tjLSTPpiGzo7Qqtmvpsm

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe
    "C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3240
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lunarclient.com/uninstaller/?installId=unknown
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3544
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8549246f8,0x7ff854924708,0x7ff854924718
          4⤵
            PID:2392
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
            4⤵
              PID:1632
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
              4⤵
                PID:3652
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                4⤵
                  PID:3564
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
                  4⤵
                    PID:3660
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
                    4⤵
                      PID:4676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4928
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                      4⤵
                        PID:2404
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                        4⤵
                          PID:2244
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                          4⤵
                            PID:4184
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                            4⤵
                              PID:4608
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                              4⤵
                                PID:1008
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
                                4⤵
                                  PID:4216
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14135635627192885069,4531819943655557623,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 /prefetch:2
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1908
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4888
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:548

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                09c7ae658385f6de986103443217840b

                                SHA1

                                298d880503edce4413337c09d3525f27a2edcd28

                                SHA256

                                91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

                                SHA512

                                4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                3c78617ec8f88da19254f9ff03312175

                                SHA1

                                344e9fed9434d924d1c9f05351259cbc21e434d3

                                SHA256

                                3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

                                SHA512

                                5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                648B

                                MD5

                                225c5bd61cb5f2817d4dc36eb0609ba2

                                SHA1

                                6ce1dd33c80f8e7ddb890730dcbab64d3e90c793

                                SHA256

                                a43943807113b9bdfc457d4573b8c6be93e64ca4bcf20d2024133f77487056fb

                                SHA512

                                87a1db917973ebbd8f58d4b44bc8e982d1a244b5a86a05b92a53b09ddc694a350da3bbfb805b752ee057fa0e39f28767ddb1fa4dbf7e110a0e31a473ed5069fa

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                2KB

                                MD5

                                a4937554b91d76285421a7ecccb2a71d

                                SHA1

                                d22cb9ece305eefafef31b39ad7696799db2ed22

                                SHA256

                                6d79ae08450c3257ba8dca736cb86fb02a1dc8314597a94c142e4682391eb80e

                                SHA512

                                de5ef72bb4f9018d2cc27247d6c7758c72ef0f9d0aa4f28ea43b8e6eb01f61e55dc91242aa59e60dd8d9761c8573fb29a20db057031df9a7a85b5e1327997595

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                68ee5f8e489ce4f9cdc9c560faca5035

                                SHA1

                                a90cfc52079751a29dbfc8cb28f32e251648fbb6

                                SHA256

                                1d435e0ef09b0c11a57de9d7642562332a17bd3d12777c333e0baa0a2a38a640

                                SHA512

                                b1484d8123ad0017fcaa54b7006989d803ba5733e7f09a4353450aa67d7b85195a5bcf5c5d1c3e6532f48150effed773056755c75abacc1479df0a85962da741

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                7KB

                                MD5

                                78a415a75053d749e12c47ec91a4849a

                                SHA1

                                a794b79feb79d2c4804858d617421fdb9a033806

                                SHA256

                                a772d840da277d10d5c9cb5a5482a5b8e2b860820226635fedb137f8e4c383e6

                                SHA512

                                790c9fc41c96ceb2ed65a65880ad8129413850a491b2dc6b0bf2b0b0456dcd97902db850f111d311a5467f1bf23723ec1f77586629bdeba071d70fd8384bdbcd

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                3d9f8fabe865147bceedf7ad7a382389

                                SHA1

                                d1afdd6c18fb5bcf63f70e31bfd3bb183e9b3a91

                                SHA256

                                79c1e0140b2e3bfc8ddfe4ebebaadedd87c1044f09a24ea45f1f47c9a25c9e96

                                SHA512

                                5a073fecd090477509687f5c39a9ab6fc90b5389a78cb77d652623178e549e06f42ae788d1cd650eef0384667fc9d6dd10162c20e80f0a41ef04b498020a5e72

                              • C:\Users\Admin\AppData\Local\Temp\nsnA6D0.tmp\StdUtils.dll

                                Filesize

                                100KB

                                MD5

                                c6a6e03f77c313b267498515488c5740

                                SHA1

                                3d49fc2784b9450962ed6b82b46e9c3c957d7c15

                                SHA256

                                b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

                                SHA512

                                9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

                              • C:\Users\Admin\AppData\Local\Temp\nsnA6D0.tmp\System.dll

                                Filesize

                                12KB

                                MD5

                                0d7ad4f45dc6f5aa87f606d0331c6901

                                SHA1

                                48df0911f0484cbe2a8cdd5362140b63c41ee457

                                SHA256

                                3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

                                SHA512

                                c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

                              • C:\Users\Admin\AppData\Local\Temp\nsnA6D0.tmp\WinShell.dll

                                Filesize

                                3KB

                                MD5

                                1cc7c37b7e0c8cd8bf04b6cc283e1e56

                                SHA1

                                0b9519763be6625bd5abce175dcc59c96d100d4c

                                SHA256

                                9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

                                SHA512

                                7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

                              • C:\Users\Admin\AppData\Local\Temp\nsnA6D0.tmp\nsExec.dll

                                Filesize

                                6KB

                                MD5

                                ec0504e6b8a11d5aad43b296beeb84b2

                                SHA1

                                91b5ce085130c8c7194d66b2439ec9e1c206497c

                                SHA256

                                5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

                                SHA512

                                3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

                              • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

                                Filesize

                                179KB

                                MD5

                                d8467036b71c4b617ba5c2d90a3c8f34

                                SHA1

                                af9542cc0c2962ef73190d6f85d43d0202130529

                                SHA256

                                970ea7020a05ad79d9d89bc584553452abf2745a7e47be6792578eb3e41fb382

                                SHA512

                                693070ec8f10ee7cab7f4ed8758723d8574a847fd8f408e5d0c445567296bbbe437d36be8ac8acd671f40c4d4b0a67b0e6fafcee1f0f6ae0dcf0cd788f0802c6