Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
138s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
10/01/2025, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
Aura.exe
Resource
win10v2004-20241007-en
General
-
Target
Aura.exe
-
Size
353KB
-
MD5
069c7b1efa0f08aebb8f8e48acf385b5
-
SHA1
f1c9e63e8d4c8038e66ac56d6edd3a82a97247e6
-
SHA256
c81f67856d1dc86fa6e487194fdff577080a5c4a3f41a90492082dee2b3f049c
-
SHA512
4c634f0a621a855133bba74bd06dd5964361d694f862f79097b68a26c0713fb813d6ab14c14a1534345521926d5e18c700c18d9f4c1433102c7569d420a933eb
-
SSDEEP
6144:9VQro8w6aEpWOpkyvyKLTZDZPY7mE6BH5EG4qhtv4D8fmrXF1ABVs0anJN0jKkf/:3QcsbW6XZD+7mEAeG3hVZfmrXF1iY0++
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
https://letterdrive.shop/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1832 set thread context of 476 1832 Aura.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 2712 1832 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aura.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aura.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84 PID 1832 wrote to memory of 476 1832 Aura.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aura.exe"C:\Users\Admin\AppData\Local\Temp\Aura.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\Aura.exe"C:\Users\Admin\AppData\Local\Temp\Aura.exe"2⤵
- System Location Discovery: System Language Discovery
PID:476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 8282⤵
- Program crash
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1832 -ip 18321⤵PID:408