Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe
Resource
win7-20241010-en
General
-
Target
ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe
-
Size
1.3MB
-
MD5
fb4f3d6f4d2b9c012ce5d29f9aba23b0
-
SHA1
9271359cd2b3c7c0a3f201c7e18c594f619a9543
-
SHA256
ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9
-
SHA512
4973c109f1000abc24b188ec71e3d853cf65f8eed6e46abc0ac0507992fcf5b50bf8c2ae37aa5139df3ac7c6bbce200baed47808e021fde0cfa70bb63497d3ed
-
SSDEEP
24576:ZPqvmF8A/lHcn0ZbNILp3T53d5M2ix82V33Z:ZS4hP+L5T537M2Ez3Z
Malware Config
Extracted
lumma
https://kitestarepatt.click/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4456 ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe 4456 ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe"C:\Users\Admin\AppData\Local\Temp\ede9c74ad63407053aadce50c61362f1e07be5037abba1930d015d70c17acae9N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4456