Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    93s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-es
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-eslocale:es-esos:windows10-ltsc 2021-x64systemwindows
  • submitted
    04/01/2025, 03:23

General

  • Target

    External2.4.exe

  • Size

    3.7MB

  • MD5

    0d59625aac6e72b533c252f60693ab01

  • SHA1

    1322f9d2daccf4ff016a73d27daa5a17b187046f

  • SHA256

    80384108010dffb5c0f2ad250925dc0fbe80a5e1dfc76fa8b2d1bcc9283bd091

  • SHA512

    0175647093c69ff3a6a403f5397933df23a5b4eddb8feceb13650e373fe7d8bf94250c0dac67d7a8b6efd34d14e112459a498851006a985c264d345fd2569227

  • SSDEEP

    49152:uR/W9yhKrDPtTbvMr2aQPF7Ifxzce3qLz+LZwlhVXaL4tE6SV1nF19B7o:uR/jitHEraLz9Fu

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://hummskitnj.buzz/api

https://cashfuzysao.buzz/api

https://appliacnesot.buzz/api

https://screwamusresz.buzz/api

https://inherineau.buzz/api

https://scentniej.buzz/api

https://rebuildeso.buzz/api

https://prisonyfork.buzz/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\External2.4.exe
    "C:\Users\Admin\AppData\Local\Temp\External2.4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
      "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4620
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4184
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4348
    • C:\Windows\System32\8kkdna.exe
      "C:\Windows\System32\8kkdna.exe"
      1⤵
        PID:3736

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4184-16-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-15-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-13-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-12-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-6-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-5-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-14-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-11-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-4-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4184-10-0x0000013DA90C0000-0x0000013DA90C1000-memory.dmp

        Filesize

        4KB

      • memory/4620-0-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4620-1-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4620-3-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4620-2-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

      • memory/4620-17-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB