Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
cf33803ead9f221274a5ef6bfd8121dce055921bbf7b8053624f22277fb00f90.exe
Resource
win7-20241010-en
General
-
Target
cf33803ead9f221274a5ef6bfd8121dce055921bbf7b8053624f22277fb00f90.exe
-
Size
366KB
-
MD5
0a42cbe3d32c42cfccf044a27e02b7ff
-
SHA1
b1414b892bfd63920dee379642c872a445cd1470
-
SHA256
cf33803ead9f221274a5ef6bfd8121dce055921bbf7b8053624f22277fb00f90
-
SHA512
1201a82fc26ac577db5a2c2280dc0dce0f7ba35bc75723165476bb3d9757dedce0b15f094cb2b19afd3e50a1d69a905ab7771f4a20644289685f06d5e022ec89
-
SSDEEP
6144:/vUtDoXMshft/ho6pOqk0pW3xKPFQ6vcmG3/8yJ7QAu7:/st8X7hoUVkaxPFQ6nKU277u7
Malware Config
Extracted
lumma
https://hummskitnj.buzz/api
https://cashfuzysao.buzz/api
https://appliacnesot.buzz/api
https://screwamusresz.buzz/api
https://inherineau.buzz/api
https://scentniej.buzz/api
https://rebuildeso.buzz/api
https://prisonyfork.buzz/api
Signatures
-
Lumma family
-
Program crash 1 IoCs
pid pid_target Process procid_target 1636 1660 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cf33803ead9f221274a5ef6bfd8121dce055921bbf7b8053624f22277fb00f90.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf33803ead9f221274a5ef6bfd8121dce055921bbf7b8053624f22277fb00f90.exe"C:\Users\Admin\AppData\Local\Temp\cf33803ead9f221274a5ef6bfd8121dce055921bbf7b8053624f22277fb00f90.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1660 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 12842⤵
- Program crash
PID:1636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1660 -ip 16601⤵PID:4808