Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
yFQFu2M.exe
Resource
win7-20241023-en
General
-
Target
yFQFu2M.exe
-
Size
399KB
-
MD5
c4d092484f2d29e4a11e3bbceba77240
-
SHA1
79cfc2e6106a6245034fda4e081d8e9e94e1b46f
-
SHA256
0d90b2123d529cf5d605cc152e1baae0e65788b6098427ab42149a76e88263f3
-
SHA512
cff1af2afaad224e624e94fe402e88559d30e1ce97a5d13690150894844c3d258a22c8f40ed95162e19f38f0d6412c2369bcadb39605623440b1e870401aec76
-
SSDEEP
12288:jQXNUkhZcgSbANJtfecc7HAl2DzZJ8y0DcJ:j5kh3+8JnQAoDtGxYJ
Malware Config
Extracted
lumma
https://supplyedtwoz.click/api
https://impolitewearr.biz/api
https://toppyneedus.biz/api
https://lightdeerysua.biz/api
https://suggestyuoz.biz/api
https://hoursuhouy.biz/api
https://mixedrecipew.biz/api
https://affordtempyo.biz/api
https://pleasedcfrown.biz/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4420 set thread context of 1384 4420 yFQFu2M.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 2808 4420 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yFQFu2M.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yFQFu2M.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4420 wrote to memory of 1168 4420 yFQFu2M.exe 83 PID 4420 wrote to memory of 1168 4420 yFQFu2M.exe 83 PID 4420 wrote to memory of 1168 4420 yFQFu2M.exe 83 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84 PID 4420 wrote to memory of 1384 4420 yFQFu2M.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"2⤵PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 8242⤵
- Program crash
PID:2808
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4420 -ip 44201⤵PID:3624