Analysis
-
max time kernel
50s -
max time network
17s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/01/2025, 23:47
Static task
static1
General
-
Target
Setup.exe
-
Size
73.0MB
-
MD5
2f84c8a115eb4fa477054b3915d6d156
-
SHA1
0aa8a86694bf487867861c8d51919b558b62ef3c
-
SHA256
a13eeb5717208e256a8b59d7baa24754f0b81f9fa9d7e7a0cf60b07fc0e489dd
-
SHA512
3c2abae78db024aded2b34c4a7a1bb1ed76afd4fcafceb7948a3a08a5b08c86e84a6b1734fb367ffdcb5d408d8dad4c85e9195ce41df4ddd6525db41df7ef508
-
SSDEEP
49152:H3UdqOr+inXPPpBs1qg5lRCT8DZ5mK5fIbgD:H8F++gfXRxDIgD
Malware Config
Extracted
Family
lumma
C2
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1240 Setup.exe 1240 Setup.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2220 taskmgr.exe Token: SeSystemProfilePrivilege 2220 taskmgr.exe Token: SeCreateGlobalPrivilege 2220 taskmgr.exe Token: 33 2220 taskmgr.exe Token: SeIncBasePriorityPrivilege 2220 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1240
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2220
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2964