Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
injector V2.4.exe
Resource
win7-20240903-en
General
-
Target
injector V2.4.exe
-
Size
366KB
-
MD5
e49046b759ea17be2794ace6d9bb57d2
-
SHA1
09cc2f51bf8669a7dae0f402f2aac9c28ee5221c
-
SHA256
b84e4e4bd1d62794453dae477ea743422cf2b0c17bff17675916f85698fa03f9
-
SHA512
4e9a8b224a9c513de485132ebd45cd75abf19605a3a7fb65ff714564c3c52fd43f81828d7978dce66bce292c99742ea4274607f452a19d6cf0a8e5fdefbf15aa
-
SSDEEP
6144:SmlyeNhHSQckHU+S6JOzwCr84dnFD2sRwY+/MmKVHNTukpyT/U5a73:tSjCJfh1YwY+/1mHdukpGU5aL
Malware Config
Extracted
lumma
https://reinforcenh.shop/api
https://stogeneratmns.shop/api
https://fragnantbui.shop/api
https://drawzhotdog.shop/api
https://vozmeatillu.shop/api
https://offensivedzvju.shop/api
https://ghostreedmnu.shop/api
https://gutterydhowi.shop/api
https://wallkedsleeoi.shop/api
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4840 set thread context of 4040 4840 injector V2.4.exe 83 -
Program crash 1 IoCs
pid pid_target Process procid_target 2984 4040 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injector V2.4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83 PID 4840 wrote to memory of 4040 4840 injector V2.4.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\injector V2.4.exe"C:\Users\Admin\AppData\Local\Temp\injector V2.4.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4040 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 5563⤵
- Program crash
PID:2984
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4040 -ip 40401⤵PID:1936