Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 14:30
Static task
static1
Behavioral task
behavioral1
Sample
yFQFu2M.exe
Resource
win7-20240903-en
General
-
Target
yFQFu2M.exe
-
Size
399KB
-
MD5
c4d092484f2d29e4a11e3bbceba77240
-
SHA1
79cfc2e6106a6245034fda4e081d8e9e94e1b46f
-
SHA256
0d90b2123d529cf5d605cc152e1baae0e65788b6098427ab42149a76e88263f3
-
SHA512
cff1af2afaad224e624e94fe402e88559d30e1ce97a5d13690150894844c3d258a22c8f40ed95162e19f38f0d6412c2369bcadb39605623440b1e870401aec76
-
SSDEEP
12288:jQXNUkhZcgSbANJtfecc7HAl2DzZJ8y0DcJ:j5kh3+8JnQAoDtGxYJ
Malware Config
Extracted
lumma
https://supplyedtwoz.click/api
https://impolitewearr.biz/api
https://toppyneedus.biz/api
https://lightdeerysua.biz/api
https://suggestyuoz.biz/api
https://hoursuhouy.biz/api
https://mixedrecipew.biz/api
https://affordtempyo.biz/api
https://pleasedcfrown.biz/api
Signatures
-
Lumma family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1692 set thread context of 3672 1692 yFQFu2M.exe 82 -
Program crash 1 IoCs
pid pid_target Process procid_target 4404 1692 WerFault.exe 81 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yFQFu2M.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yFQFu2M.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82 PID 1692 wrote to memory of 3672 1692 yFQFu2M.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"C:\Users\Admin\AppData\Local\Temp\yFQFu2M.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 8122⤵
- Program crash
PID:4404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1692 -ip 16921⤵PID:3612