Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
CsNyImE.exe
Resource
win7-20240903-en
General
-
Target
CsNyImE.exe
-
Size
404KB
-
MD5
c9c7d2de539b4b1c93776286a9d064da
-
SHA1
2c40996830841153ecd76c1fba2d64e39c7321e9
-
SHA256
fd6bd9a37677899ab77945288508f6946c0ec955b7cdc2bc106a0b6d5de67c66
-
SHA512
6c1c6536c62a9dd4c5bd4074a27e3cf45a58acbd92b4cd466c30ab95d15b404970c123a993243623d2280f4a711fe64cf33af7e53cdb501ff95073f7e22c617a
-
SSDEEP
12288:oQXNUkhvrUrv9ysegjTkH9O+OYJ0Lr8zspre4J:o5khwrvpeaTkdjOxr8zIrRJ
Malware Config
Extracted
lumma
https://impolitewearr.biz/api
https://toppyneedus.biz/api
https://lightdeerysua.biz/api
https://suggestyuoz.biz/api
https://hoursuhouy.biz/api
https://mixedrecipew.biz/api
https://affordtempyo.biz/api
https://pleasedcfrown.biz/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3172 set thread context of 1388 3172 CsNyImE.exe 85 -
Program crash 1 IoCs
pid pid_target Process procid_target 2172 3172 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CsNyImE.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CsNyImE.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85 PID 3172 wrote to memory of 1388 3172 CsNyImE.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\CsNyImE.exe"C:\Users\Admin\AppData\Local\Temp\CsNyImE.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\CsNyImE.exe"C:\Users\Admin\AppData\Local\Temp\CsNyImE.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 8282⤵
- Program crash
PID:2172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3172 -ip 31721⤵PID:3220