Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
43s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
21/01/2025, 14:48
Static task
static1
General
-
Target
a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773.exe
-
Size
9.7MB
-
MD5
c4cb62a984955f3ad185c1b289d816d9
-
SHA1
afaa3f895bc307c7dc41f9641a5c757a82e0c5fb
-
SHA256
a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773
-
SHA512
e71787abde38d3c502f79299eb55b881481679cd450cd06439a40c89273e1af8f5bd6bb892fbc916a6c92154c5c5553fb86db2b3143bbd24b15b013122e6643f
-
SSDEEP
196608:rhnqDr/8t91hdgoTEPP/Ts5IjIxdZDr/8t91hdgoTEPP/Ts5IjIxN:pqDr/8tlmUuPbMIEXZDr/8tlmUuPbMIo
Malware Config
Extracted
Family
lumma
C2
https://bashfulacid.lat/api
https://tentabatte.lat/api
https://curverpluch.lat/api
https://talkynicer.lat/api
https://shapestickyr.lat/api
https://manyrestro.lat/api
https://slipperyloo.lat/api
https://wordyfindy.lat/api
https://brendon-sharjen.biz/api
Signatures
-
Lumma family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings control.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \Registry\User\S-1-5-21-556537508-2730415644-482548075-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1044 explorer.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 2584 a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773.exe 2584 a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1044 explorer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeShutdownPrivilege 1452 control.exe Token: SeCreatePagefilePrivilege 1452 control.exe Token: SeDebugPrivilege 2824 taskmgr.exe Token: SeSystemProfilePrivilege 2824 taskmgr.exe Token: SeCreateGlobalPrivilege 2824 taskmgr.exe Token: 33 2824 taskmgr.exe Token: SeIncBasePriorityPrivilege 2824 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 1044 explorer.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe 2824 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2824 1044 explorer.exe 82 PID 1044 wrote to memory of 2824 1044 explorer.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773.exe"C:\Users\Admin\AppData\Local\Temp\a42ce4178e7dc0be9b8f8b91ef4af38e05c66c587b7ae80840cc60f45051d773.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:4488
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2824
-