Analysis

  • max time kernel
    479s
  • max time network
    846s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2025, 15:25

General

  • Target

    luna-1.6.8.zip

  • Size

    5.5MB

  • MD5

    24fea6dd585a009c3ff441760beae097

  • SHA1

    1920784c67ed8d49b611842b9643000aa0d8752c

  • SHA256

    0359c34efaf6025a0dec1cf80b5bcbb9b20517be4bca8945af0391049ed2c134

  • SHA512

    8f060951722ae1420812a36f12d64ded40de1797fdde3ac1591e143d9b3233174996cad0405eda36f3fc410e1abeb791d36a3a437bda2afcf4aaf1a2379f6f6a

  • SSDEEP

    98304:gUZug/1mvXA/eiMVm7TZJ4xpQCQqoInFaGZV++7n0hTMuymld03bD0D1fd9kRUAU:FogNEziam71IpQgzF/ZE+7n4t1A330Dz

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\luna-1.6.8.zip
    1⤵
      PID:1972
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d89758,0x7fef6d89768,0x7fef6d89778
        2⤵
          PID:2696
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:2
          2⤵
            PID:2872
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:8
            2⤵
              PID:1920
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:8
              2⤵
                PID:3012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2156 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:1
                2⤵
                  PID:2308
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:1
                  2⤵
                    PID:1196
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2576 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:2
                    2⤵
                      PID:1924
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2428 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:1
                      2⤵
                        PID:1848
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3704 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:8
                        2⤵
                          PID:3040
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3768 --field-trial-handle=1236,i,14641804788971593385,8557210223954194770,131072 /prefetch:1
                          2⤵
                            PID:2944
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:1992

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                            Filesize

                            214KB

                            MD5

                            ba958dfa97ba4abe328dce19c50cd19c

                            SHA1

                            122405a9536dd824adcc446c3f0f3a971c94f1b1

                            SHA256

                            3124365e9e20791892ee21f47763d3df116763da0270796ca42fd63ecc23c607

                            SHA512

                            aad22e93babe3255a7e78d9a9e24c1cda167d449e5383bb740125445e7c7ddd8df53a0e53705f4262a49a307dc54ceb40c66bab61bec206fbe59918110af70bf

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                            Filesize

                            16B

                            MD5

                            aefd77f47fb84fae5ea194496b44c67a

                            SHA1

                            dcfbb6a5b8d05662c4858664f81693bb7f803b82

                            SHA256

                            4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                            SHA512

                            b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                            Filesize

                            264KB

                            MD5

                            f50f89a0a91564d0b8a211f8921aa7de

                            SHA1

                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                            SHA256

                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                            SHA512

                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            f8458ef01101ff15e84f74bbd65111f1

                            SHA1

                            abb7fb9a6e9bcccb546eb999e7f71faa3379337a

                            SHA256

                            1345e3473dbc289db2315ebcb04ad8f7a480f40751fd9816be578762c4771877

                            SHA512

                            b55291196d5e820fc290fa9972cfc5223d50220d0aa84315d2a564fe37d85ac99c3224f0dd604e92029d108b646fa44d36e1163b23ace361c24d24785293ef3e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            0b7700753dbaca6bd8ce0755f71235e4

                            SHA1

                            c70bec9e322b0c8beec193666e2cc37896c1d242

                            SHA256

                            00048c01e527dba608bec5d05bb191f166d4a2822a7c5d5583df480f4c0a3870

                            SHA512

                            4dae13787b2840287c5ff9cb5d475f79ef25d863237fc2226d8b9c4793171a8f051fcf65aaab4e8ad18b34babdec70302b89af5aacb3596184afd6299e446561

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            d672f13c1148cc3380349b6bfba29c5c

                            SHA1

                            d6283e877d86332750d2b0129931c43810fddf43

                            SHA256

                            1174d2b9d456f53a7b34a55699953aa8f6a7cd7c828dd3d372098cd8836a42d9

                            SHA512

                            c1487acdddd43867f6c365d0f240fd8943da6d170d9a8458ba32ce5fb29ae39f79d8d7a927b7e4ff19a34d1d91da4b5503904ca35146d2fb3d6f488a0ff2d7d8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            43c75c85297c0dbd7b62d50d1d8e2647

                            SHA1

                            44d1f3a370c83ed7547a109b275fbf4aeb5c592f

                            SHA256

                            43d51e9c5710f86b8a6b925da6f9622402f64f376b6c60b9c555f37213a2a795

                            SHA512

                            e5e53a75e05ec4893ef375196d958fe40f924733cf418896b915ae5150ba53f29d315084da10355780544f05fad9ecce3fae7312a1161a8a3199fac6f68069a1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            3a18ace67f33fd268833644e087901f2

                            SHA1

                            ca781bdbcf618ff346817e1b68c0cd8089c48bb8

                            SHA256

                            ec6d1d6386d93b8b5d6467fb2291b9eed2afe444d4a4a63b7499dae28d9cfb6e

                            SHA512

                            0704044f3185dba6b00e82f1ee4ab09fc9a063b8da8b35f4c7da089eb1f07de95eda22c04c008be17ce8954dc99074fb66cc37a406c28ef3f40b97e52e48125d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            a732d1533d1e43ed8778933e2d511e42

                            SHA1

                            2e613cc097fc29bd7cf0b375bda1c60b414e8a66

                            SHA256

                            cc3c728628ba86f1f4878f604ec4dae557bba53662ed9460283fd33aaa76d584

                            SHA512

                            12437512132f356c46beda12a6a62cf7da766189c56b5c4174e125cf6e756a7b62115e7255d67b0870676c68e65bbfd86d7893a5099fe5ca256abb4d64f4f6f8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            71e5c5a4139815753728980ee471e49b

                            SHA1

                            43dd57e03f78b0563dc18926ccba85d8984e0722

                            SHA256

                            95c82196b6c374c0e4bac9929cc3d85612f501ce754351ad5a485017c239543b

                            SHA512

                            a2403e3e86b050cf54d61e3d39bd94965ee34cf31b557bff382a1fb9996ca6a242c81877e56cbc81f3621a6258cb2e05f2ea1c40b224b5dd133e3f7a37fe9b96

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            db573663a5d133a3f6b553a4a60e5b5e

                            SHA1

                            e4f822b45e420fa49ea0033910a2b9626f4f5304

                            SHA256

                            f6c72e8ed44de99c5bf37e1c970ead41b2e2f8896ece7a5625edf64e4ac6720b

                            SHA512

                            30eb22e05063532516a485f09736d479af3a2885e4a1d41fbda4a7719581948270bf1bb1914be0ebe889c01e690f20981aaeb7f338383e621000497239451b03

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                            Filesize

                            16B

                            MD5

                            18e723571b00fb1694a3bad6c78e4054

                            SHA1

                            afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                            SHA256

                            8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                            SHA512

                            43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2