Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 00:03
Behavioral task
behavioral1
Sample
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe
Resource
win7-20241010-en
General
-
Target
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe
-
Size
488KB
-
MD5
4e54c5e3ad2d51863f7bc5ba732f3b3d
-
SHA1
db604b209f42ab64a3af4d7d81d54ae51c520188
-
SHA256
8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad
-
SHA512
30522976db4dc4fd512fb1c61e8d43a42b27b8d1b12ea5028743cd2a7fe3b9300e6551b0180bf462d433aa1c76f570985b842e4153819dae8d911c3705ed92d0
-
SSDEEP
12288:EQNbVxTVzC+QjqzIUBVDN/u3JBLdih8dEho8HzA0l8mbH3su8d:EQNJtVzC+QjqzDtu3JBRw8dES8zjl
Malware Config
Extracted
lumma
https://cloudewahsj.shop/api
https://rabidcowse.shop/api
https://noisycuttej.shop/api
https://tirepublicerj.shop/api
https://framekgirus.shop/api
https://wholersorie.shop/api
https://abruptyopsn.shop/api
https://nearycrepso.shop/api
Signatures
-
Lumma family
-
Loads dropped DLL 1 IoCs
pid Process 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 920 set thread context of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_regiis.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83 PID 920 wrote to memory of 3228 920 8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe"C:\Users\Admin\AppData\Local\Temp\8f14e9b530be16e216c301787ac5684b62554494bd3ac7a74dfea03299f105ad.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD516b4ba7659f12778088d2f76ac4ecc64
SHA163050c063455316a565e426112a7561a547e13ec
SHA256dab9fd3f8c26bb886c711c08ae58666571325ac621d3b01bf56bde67ebb56f19
SHA512b059bbaf663e487c418ae341c4095e6450a981b7f392b66100d925b8fd799b898f804f0d3bdc8ce0d106326f019e8c80b5e5b9df5206c915c7df398a70a8e78b