Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/01/2025, 21:12
250103-z2cl6atlfy 1003/01/2025, 20:40
250103-zgabassmaw 1003/01/2025, 20:37
250103-zelljsvndk 1003/01/2025, 19:29
250103-x7cg8sslen 10Analysis
-
max time kernel
38s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/01/2025, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
Resource
win10v2004-20241007-en
General
-
Target
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe
-
Size
1.1MB
-
MD5
79972f296cb418a20b17d2440850d790
-
SHA1
3a096f7084a15176a30bb69126468059846c30ed
-
SHA256
14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0
-
SHA512
9d0632eeb7c6907b70fe2dce984b20b0e83c1c4c9b0a2cc17c01f7b2be53171c5beb5c9fb5994ba51ebd2e83d3d8579e732535097b85681a3305914c3d89d38e
-
SSDEEP
24576:Rz/BfKdNZHQMtptCohxX+8Fn90yIJKQ0lTF0D3+kyOdsa1:hZE/HQM4ohxXz95IJKlJ0ypOdR
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Signatures
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
description pid Process procid_target PID 3240 created 3528 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 56 PID 3012 created 3528 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 56 -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3240 set thread context of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3012 set thread context of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Token: SeDebugPrivilege 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Token: SeDebugPrivilege 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe Token: SeDebugPrivilege 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3240 wrote to memory of 504 3240 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 85 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108 PID 3012 wrote to memory of 4624 3012 14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe 108
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
-
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:504
-
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"C:\Users\Admin\AppData\Local\Temp\14bc1edbb127c33a2a10758ea83d607a3cc26f34082713f9497aa6ebd7f51ed0N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4624
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5060