Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
x.exe
Resource
win7-20241023-en
General
-
Target
x.exe
-
Size
1.3MB
-
MD5
a0f063b82ce5a44aba075f17b9284bab
-
SHA1
e1c46fb92ff3827347c47362511ccb0b1b09f123
-
SHA256
0567b98365f8f5e5a3adf508dc7234ea7b50270a8106c3a66a0da96f38058118
-
SHA512
53c13f552eba709d7a558b34c2c1ecfd35b42391b33fb882a4cb3fb3c667e4d1c4e269e7d8b3d0688bd750912307cec1612bde9c0c967615ac34f4d015ce5d29
-
SSDEEP
24576:QxrfEXAiIKn+pSBDXQtHjoD4eS8QfuBeeTAi/ZIwoMmoz8qj7UnaBK9PIU/gsjTO:a8QGBeqvBbLQqqIiVTvsBV
Malware Config
Extracted
lumma
https://robinsharez.shop/api
https://handscreamny.shop/api
https://chipdonkeruz.shop/api
https://versersleep.shop/api
https://crowdwarek.shop/api
https://apporholis.shop/api
https://femalsabler.shop/api
https://soundtappysk.shop/api
https://charminammoc.cyou/api
Signatures
-
Lumma family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3028 created 3500 3028 x.exe 56 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3028 set thread context of 3356 3028 x.exe 84 -
Program crash 2 IoCs
pid pid_target Process procid_target 1660 3356 WerFault.exe 84 1980 3356 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language x.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 3028 x.exe 3028 x.exe 3028 x.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3028 x.exe Token: SeDebugPrivilege 3028 x.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84 PID 3028 wrote to memory of 3356 3028 x.exe 84
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 12563⤵
- Program crash
PID:1660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 12483⤵
- Program crash
PID:1980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3356 -ip 33561⤵PID:2144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3356 -ip 33561⤵PID:4084