Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2025, 08:18

General

  • Target

    Setup.exe

  • Size

    1.1MB

  • MD5

    f055691b21ccb5cf9cf213b8d1bc41f7

  • SHA1

    bdce3533a74a923851deb05ad94dc4ef911ded90

  • SHA256

    83499bef9c13f62673773813aed1d1b051866e6904183670040069686278c5d8

  • SHA512

    41b560661f79e60010aaef7ad6588a7f14dff26b462a4ecba2e726486d182916b651b595415320983cb3856b01b643bef08ba7e93e08901ccb3157e39075482f

  • SSDEEP

    24576:0M/wwRvEpNfw/mwZ9ilkBXpFwaBf62u5zaoM5OA4bHJHBhz1wJaP3w3:IpNY/BiCzFwWo5moMIbHJfX3w3

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Bonds Bonds.cmd & Bonds.cmd
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4028
      • C:\Windows\SysWOW64\findstr.exe
        findstr /I "opssvc wrsa"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1572
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3536
      • C:\Windows\SysWOW64\findstr.exe
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4088
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c md 339474
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1468
      • C:\Windows\SysWOW64\extrac32.exe
        extrac32 /Y /E Roommate
        3⤵
        • System Location Discovery: System Language Discovery
        PID:544
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V "PERFECTLY" Ruled
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3228
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c copy /b 339474\While.com + Fitting + Engine + Reasons + Immigrants + Colony + Fired + Speak + Selecting + Element + Italic 339474\While.com
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1540
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c copy /b ..\Miniature + ..\Triumph + ..\Cialis + ..\Downloads + ..\Satin + ..\Mate K
        3⤵
        • System Location Discovery: System Language Discovery
        PID:244
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339474\While.com
        While.com K
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1828
      • C:\Windows\SysWOW64\choice.exe
        choice /d y /t 5
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339474\K

    Filesize

    457KB

    MD5

    8ff92c3cfbe56b0aae16ebd1f56a01f7

    SHA1

    ecbafa5e60885b4ce21ec3525fff09a7b2148ed6

    SHA256

    e235b5e2f0863e83dbea87b9c98eaf2e7f0cc43d6217e6a454c27837a6dc657e

    SHA512

    dd8ad6852ff52b85bd01ad3bbbd7cbcd6b3d45e33da3dd96c70625ffd523e6ad2dfded7e134df4a67d808cc974de7fa0451c8b61ad69b3fe24ef33d5de85a7b3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339474\While.com

    Filesize

    361B

    MD5

    3c3aaa8b37c9b0a0b563694cdc45b7b6

    SHA1

    43773add7c936146a774f55296aa8536be9a23a8

    SHA256

    dbdce353e2dfc11844fcec9edf4ebc2f346bcb9a71c9172c7fefa3716b853349

    SHA512

    3fa13a634d4104cb1b045608c70f9250f002e6e5bceec120154294e24f1240c9b52fe09f59f4f9885c1507b9320b10fab1050d396602e5168f5e36574a81ce6a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339474\While.com

    Filesize

    925KB

    MD5

    62d09f076e6e0240548c2f837536a46a

    SHA1

    26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

    SHA256

    1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

    SHA512

    32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bonds

    Filesize

    10KB

    MD5

    e1cd007cbc539894807f0fcc6655cf21

    SHA1

    a2a046bbf907021559f3ae6fbf0ba2813fb11f99

    SHA256

    6b1ada2c25358700ae6e001a9f262bdc5b33e18d7642b65ffbaeb508c4e9e47a

    SHA512

    639d5760b95c92ad6b6c69f16b5141a909d42af187957c6b11f4f9220d90c7204427da5e44f855d7cd7a3d50eff335a06b3d8f347a0f88cf1722511d5667421d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Cialis

    Filesize

    96KB

    MD5

    f292981413fcd87d85f559568c28fba3

    SHA1

    2dd36a59c3a98914230c22a6f22e77619e2f2101

    SHA256

    bb80896e8e7f604c79fb8a5dee1d1de5dca7b254e1562cda5d6524eb69feb4dd

    SHA512

    3f3e7251596ec4bb6e0062595ccd4eb7743b7098ce64278ff1a9bbaa416bd382a5b2b79a38e6d96cbd778ef6e7baa987a32a3f54159c6541f8f63738051e1efc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Colony

    Filesize

    56KB

    MD5

    11ef20e1b4022d8a8283962abffec417

    SHA1

    9e77b02b7dafba36d3351164b3fa3704a015a512

    SHA256

    c16b55c51e0cde84a6fe89035681b9e3ab94a0023930d3f87e0e141ef2971f0c

    SHA512

    adaa2fa449aa6e5a5bb081d03e0ed018cc9da0ebe5f621fe132bbe3d2efc798efa3b3941ec3f54cd34ef325125906f20e6ae3c0103742a1dbbfe90d7d8c4ba9a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Downloads

    Filesize

    96KB

    MD5

    ce4b1c9d859bfa66d70a4de5ae8bbcd5

    SHA1

    489b4436ff4da4ce7dc735ef2b95fd439e741d2e

    SHA256

    3b824d92bf2d0d00dd3238f60ab7c05139fb50c5c92e62ab0c1a54d8b258b325

    SHA512

    a36ab4baccc0aeaf1ff1df70c8a714fd341ea5210ba0f0c15ebc7fe3f77165b47ec840aa8996abd41294de7caf44b28fbf211bcccbe6eba0061d5658284660b8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Element

    Filesize

    77KB

    MD5

    bf9fbd4e02648bfd30ab88a962d3095b

    SHA1

    128cd6a2e4eed0d92a0707823b62168db7b74dab

    SHA256

    0a0adff3b071b2f5c5e1c6d2ee6c294c3f14ba76170895419283d66c34192382

    SHA512

    2f76b523de8f63098aa296e5efe11a8ba1cab29d28c0442bad07bbddb5732aa080b9499054e92e4f053e5d040a8403a9d916f66ef32e21e119f5e9239fc44279

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Engine

    Filesize

    102KB

    MD5

    c1990d5b44f5f9e32f46f28b7eb30d8c

    SHA1

    29c810996a527cfb5f568ead13e3ae8afaad6614

    SHA256

    f05af6d4c7155e20ce4842e11e1cbb379ad50ff930f3ec6d6fb8612b687a5ab7

    SHA512

    20dca786baaa2afced1a1e5aa5e7aa18f59e17a70c71de927a8d0391947df08198f9045a56548ac0a6934ab755eab88c3ca1f3f949f78d79807a00dec7d630c9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fired

    Filesize

    115KB

    MD5

    de86154691008fcde6a29ec4146736c0

    SHA1

    96446b08fbb349badb085b3f698c81042ba4034b

    SHA256

    a6818911b287821f3c96ea6791b48b89eed0f86f2c039141c27b84724872690e

    SHA512

    0e24a2f58d8770019f16d1ad5aef888961f86f8025fefab43852af63065f8f2b4bedc68c6defc86aa05244d7b6b1baa9c271f74c447a7aa097c910057af82c41

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fitting

    Filesize

    147KB

    MD5

    ea871b11c576a77946f746ee53ac6f86

    SHA1

    7cbbffe28838c1e604a0ec4dde30e6b207ff313d

    SHA256

    be1430b9962146abdf2554dd59dca695565a2dcc27a8d3f96c3bb0c175ebbc32

    SHA512

    fa8755c88555908b01fca6efacbe041d76559151e17ded358235253251ee2abd3ba74de8191e1ecb2dd432b70fc0add2635080a67bc8be6b150a9ad2303522a3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Immigrants

    Filesize

    88KB

    MD5

    744d105b162b411f84bb2170fc7ce9f1

    SHA1

    83ea2d09fe1ee6b1e3f7779e0a5847eb929da56d

    SHA256

    8c56963dc7859a57a18ca458cf2b121b3e158af214f386c4ed4e13a0de08d8e1

    SHA512

    ab4620caa8403bbf4249aabfb477696063a95e1608ef6165ed964033964a3d8f2fa62f0d7e3a9393619b8817a8cfbde1a4b1997f90241b9ee0558a0d11a357bc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Italic

    Filesize

    43KB

    MD5

    03a76741f860a345969e1a5c0b6898a3

    SHA1

    8fbbdf6e3d9de107e890219fa93666c4938d2c57

    SHA256

    b195744ed5b187bacd65a22c00360c6f9dc69ea9e8e571ffbafde8344702d66d

    SHA512

    be215a2317938f8ffa74d972c9acffa43a0095ffa586857547683e5587ed3fb8a73f1637cdc57f078f10a7e4c24c3ed816ad124895436f7ede54875ff89a0535

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Mate

    Filesize

    91KB

    MD5

    fb3c1b1e5b0ea73afdfc5a0111c6d45e

    SHA1

    15bad2a6d6fb4776f6b547f5e38c8b95a050690d

    SHA256

    ee3eebb6f9aae1e96077e71fafe4327dcc1f236ef442379788573e0506320016

    SHA512

    a11083ab77fbbd21389d0419696954d17524aa04875d72e92e49b74e6abb42aa49279b82cd67e27968db96c27fa4657710886db6bd78feef5f2fdbc73fa0b395

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Miniature

    Filesize

    56KB

    MD5

    2c5c854d5f9db70e9fbf15cb32aef5a6

    SHA1

    6f20d1ab6ae2476dbe6b05f5cd379d2d574efd36

    SHA256

    2c633853c2a9292bbe47bc61234ec76926446a29dd6642019d62c0937ef19276

    SHA512

    14a5d07b303c48e3db36652ea9daa041fec8c3b807085b37aeb56c342ca939c6f8775dcfa71997055060c2fdba2d92635c3b554e98b0b936e8f6f96a5c5c6258

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Reasons

    Filesize

    50KB

    MD5

    30b97e452682502b1c0075cb4a263a8f

    SHA1

    9d431e0790b5fc3f9b3ac9ba340b5417f84aa8d7

    SHA256

    e58f03cbe565e6dc6591a1d6194b87d08bb574e2d925e63cc263de83a8e97ef1

    SHA512

    ab887b8415ad4a8204e24a991da230fd6639c5a53135904b44971bfcfc28fbec3a18cbf0509a32b3aae6bf1a0619830179235ab2e4b36a51ed1be6d24c57bb1c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Roommate

    Filesize

    478KB

    MD5

    787890a49a3c79fad4a7df8a0265d5ab

    SHA1

    6303424d11585dfe0992a8c021557715d5e1db74

    SHA256

    1dbacaff9f0a1fa4efcd8f0ca8d3ccc9f1bcb1c01252b214f61db4d2892f66d2

    SHA512

    ee2f02716c1bfb3a4200a7c5ee98c365ece476e536a76ea474df7dd7fde1542317950c5f3342e2d4036f60b70cad0b04c7962f2b12bf5afafd5a1dd0a36e22d0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ruled

    Filesize

    370B

    MD5

    b97a1ce3e7053cfd3c5c459cd3bc2678

    SHA1

    bf3b482959d3edcf3307d493363920c68ec05dc7

    SHA256

    22dd6e124eb389c162be6a1ddc50c2b3981f15852dfed6cfda27898f4437d194

    SHA512

    ba3366f058055a8566aa51a4b37b0a5cfa58015dc2e47d5c03e69f6dde195c35c15d61f0b51308891839860c2cbf7f814c5a9640205518f1af8727863725c2f8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Satin

    Filesize

    53KB

    MD5

    a0075f0c467d59cbc3197dedb784abf9

    SHA1

    ea2549868ca29c1a8b43840b93674a343f856521

    SHA256

    323ee834cf50ab0ee16c15fa85e0e7091325bd619efe152916aa05002833eab3

    SHA512

    71459887143b7629bcd8ea79d7009e99ba49e941af108ee4369ac1c76a5fb9e48870b0bcb2c45cc210e573d348f1daad27f7587b0da8037ec0540eeb7064ee8e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Selecting

    Filesize

    107KB

    MD5

    72226b392ba5391978f5d7f09b8db2a4

    SHA1

    b35f2d4f09d8773324ca8cbc508396957e109f55

    SHA256

    344a278772a562715ded572168d6270ac6e0dbd511c92e43c712604a6de9e6be

    SHA512

    12159c4783beed0ce73fe37a9d8411420d0558fee5527a492d7ab492423db11bd0546dc133dae2e1843e54afbff0d365fa4991850da413fda2c0582a769cf562

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Speak

    Filesize

    139KB

    MD5

    6dfce423d36b3537267dbbf8cb6a5444

    SHA1

    abc5dce9415321459f5ce63444bf8e86e08dd73e

    SHA256

    0c98a2b0ea7277a2a6a6a4fd821d629469642aa8a74fb27b43a1be2d94e31795

    SHA512

    e0bda21fc4d3da19382011a1862bcd9164e444d75f104198af40d0d17a69ae48034f6593caa6432b2c327bf06742425da3ebfeaa375fbe71dfad485abd9a2422

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Triumph

    Filesize

    65KB

    MD5

    091194c1fbd7b7232ef54b5467834b09

    SHA1

    88584813475d1effdfe06d8f7975821e4d4708a4

    SHA256

    3c4246f75daa7af377509c3513eaf52924af647293547453c1e71d04eef23395

    SHA512

    62bdced6b22f7be4c2f84dcf4e3a57d4b0011982034e10b61f5d32896529f585c51ca656a380e8b0e38664ccedf90fe6f2b16106e0d1a68759a07bc8b3be45f3

  • memory/1828-68-0x0000000003EA0000-0x0000000003EF6000-memory.dmp

    Filesize

    344KB

  • memory/1828-69-0x0000000003EA0000-0x0000000003EF6000-memory.dmp

    Filesize

    344KB

  • memory/1828-70-0x0000000003EA0000-0x0000000003EF6000-memory.dmp

    Filesize

    344KB

  • memory/1828-72-0x0000000003EA0000-0x0000000003EF6000-memory.dmp

    Filesize

    344KB

  • memory/1828-71-0x0000000003EA0000-0x0000000003EF6000-memory.dmp

    Filesize

    344KB