0359c34efaf6025a0dec1cf80b5bcbb9b20517be4bca8945af0391049ed2c134

Analysis

max time kernel
835s
max time network
840s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/02/2025, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

luna-1.6.8/config.json
Size

127B
MD5

7fd96c6b742155f97e726cc3cd30659b
SHA1

ce5a0469f6eced916931de46fa65b2efd7b7318c
SHA256

1d5786aa530af255c9e5267e3637db5898953c849a1be1250eba156823e84a10
SHA512

905505bff84af6370ff235ce2e49752320e2f62081981098011c672da2225f736d07410a5fdd37ca4133cb1ad1dd0547e8b5c0125698964186e02df3ad1a8434

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2020	2272	cmd.exe	31
PID 2272 wrote to memory of 2020	2272	cmd.exe	31
PID 2272 wrote to memory of 2020	2272	cmd.exe	31
PID 2020 wrote to memory of 2712	2020	rundll32.exe	33
PID 2020 wrote to memory of 2712	2020	rundll32.exe	33
PID 2020 wrote to memory of 2712	2020	rundll32.exe	33
PID 2020 wrote to memory of 2712	2020	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\luna-1.6.8\config.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\luna-1.6.8\config.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\luna-1.6.8\config.json"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
58c7f7fcb4ecad7d594cb634b7267dd6

SHA1
ca9850c5880f3f43e4051e2f25c3f6eb62d6d487

SHA256
098de5cd11637d444bd17f6951da29075f87bd3ee29536f6ec94c470301620c5

SHA512
eff313cd4f770e0592f669e7d57f56d5d7d16710704e873ee0ac8f5626f22d85dffb4cfee12b4e9be0b7d07eb994796fa7f696b14cc9a64e6b7e7e1b2dbf9a5a

Download Submit