Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe
Resource
win7-20240903-en
General
-
Target
cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe
-
Size
21.4MB
-
MD5
49ec80bf172ef2012a08499781c31310
-
SHA1
f2822f1e17e69c8d3aafa33cebd8125e94e0c311
-
SHA256
cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3
-
SHA512
d2cbbc02ac51cc2baa19b3daee30336e76ddc2340d00e478be8e109bf6eaa92a31babdac38fd2e44f7d45dc4e3c4dcd98da77388ebb10d7617a652bd135d7175
-
SSDEEP
98304:118QEsEAjX/ZgRhoxKTx5q0bTZ4W9x8Q3CmZQk7LPSeORlzoTJTGefnoGC9DwM52:vEzArlo8iuWDi5m6efZMzSj/82
Malware Config
Extracted
lumma
https://femininedspzmhu.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3896 set thread context of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93 PID 3896 wrote to memory of 2132 3896 cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe"C:\Users\Admin\AppData\Local\Temp\cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2132
-