Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 02:18
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20240903-en
General
-
Target
setup.exe
-
Size
793KB
-
MD5
5b3e5ace672f4250aeb06382579d165d
-
SHA1
5f1d413192d92fa9a58cd5208963cda6c6c7c678
-
SHA256
1f8c9a3874f67a64d9ffff9f73d608d62dbd93a443404d969455e03b62e5fd48
-
SHA512
115551e9a8186986761c03d66928e432410b9c310f2dd862155cfddf1dd01133563a611e12998e898cbd78dce5ad8c2f4da923c5c2e3cec08d20bd38d644695c
-
SSDEEP
12288:d3K1Pp+lMeB8UODTAFKHMRTviTOODTAFKHMRTviTr:JK1PSMZx0FKsRTqT/0FKsRTqTr
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Extracted
lumma
https://abruptyopsn.shop/api
https://wholersorie.shop/api
https://framekgirus.shop/api
https://tirepublicerj.shop/api
https://noisycuttej.shop/api
https://rabidcowse.shop/api
https://cloudewahsj.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2528 set thread context of 3496 2528 setup.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84 PID 2528 wrote to memory of 3496 2528 setup.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3496
-