Resubmissions

22-11-2024 11:45

241122-nw5j7szme1 10

22-11-2024 11:43

241122-nv4arazmdv 10

Analysis

  • max time kernel
    49s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 11:45

General

  • Target

    Microsoft-Flight-Simulator-2024-Crack-main.zip

  • Size

    9.0MB

  • MD5

    744a2b0e676d60066f52e1633724ac6e

  • SHA1

    a79fef883557e49ed5a923d920d4178fcdbc2a0a

  • SHA256

    fb5fdba6e89240c8b99c11923471a72975e0026e5df97dcdd3c41caf759527cf

  • SHA512

    691f4a1ccb47951b0b9973edfce56200e7ee3337e2f7d19bf86beeba03d25ddb3d2e9c563d9322a2ab27becacafa27c7d2ab40f7c5eb5a0c2e0079f6d0d00b39

  • SSDEEP

    196608:wAN6NV02cQGZSZyWCidFEs6CHdeuYqBOEom0vBYOzssK0kgApMe+02CnsjUQNrIl:wm67lL+KG4iFEwWOJmGB9aar9geUorng

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://fumblingactor.cyou/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 29 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Microsoft-Flight-Simulator-2024-Crack-main.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1936
  • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
    "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:2520
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:1932
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:2496
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:2944
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:2956
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:1228
  • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
    "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2272
  • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
    "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      PID:1952
    • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
      "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:1452
  • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
    "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:3044
  • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe
    "C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabFA39.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarFA4B.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\Desktop\a\Microsoft-Flight-Simulator-2024-Crack-main\Microsoft Flight Simulator 2024 Setup.exe

    Filesize

    570KB

    MD5

    d9d221384b7ac1af1cb64bd042cb16e3

    SHA1

    6a7c441f093ed49fa0f708a52a830e62ec2f5ce9

    SHA256

    46d8066bf56c854646b39a04ad298ac22c81f3c9545bb439763c91e40bdc0655

    SHA512

    dc52905cce2ee9bb75b15116c5f825ff295ca256bfc2c12d3cab349aaa2916cbd1970e142ff9a296ee80734b719cca68d5519c7328d18d51bbd3d482228f0b8d

  • memory/1228-28-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-32-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-30-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-34-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-26-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-24-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-39-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-44-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1228-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1228-37-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

  • memory/1452-68-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB