Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
09/01/2025, 02:21
Static task
static1
Behavioral task
behavioral1
Sample
586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe
Resource
win7-20241023-en
General
-
Target
586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe
-
Size
339KB
-
MD5
20155323669fd610a0c7201be666fbd6
-
SHA1
99bb4dcee2ba86b0f6220ecbefffd1700e44ba71
-
SHA256
586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442
-
SHA512
338382b16e2cd2b3edce364aa2f92281769ee39dcfb990b6da94dcac477df9c29ef25636026e5a8491e5a3fe2c24b04d501b94e72935501a32af1db8d5d196c9
-
SSDEEP
6144:yZZzgHPaRciI8PDjb17g5esNPwOR716Z6NWk8C93PG+gHT8oAu7us9SOv3KZts:y/Dq18PDdJNOR7cZdk8CZBiT8obus9Lj
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1584 set thread context of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 -
Program crash 1 IoCs
pid pid_target Process procid_target 1696 1584 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 2604 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 31 PID 1584 wrote to memory of 1696 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 32 PID 1584 wrote to memory of 1696 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 32 PID 1584 wrote to memory of 1696 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 32 PID 1584 wrote to memory of 1696 1584 586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe"C:\Users\Admin\AppData\Local\Temp\586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe"C:\Users\Admin\AppData\Local\Temp\586b3a854631ed30c8aefbde7edcf3a725d7c40a4a56c8ebc17aeb64979ea442.exe"2⤵PID:2604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 682⤵
- Program crash
PID:1696
-