Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1803s -
max time network
1262s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26/08/2021, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
06a029882deabf229f62728afe3baf4f.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
06a029882deabf229f62728afe3baf4f.exe
-
Size
319KB
-
MD5
06a029882deabf229f62728afe3baf4f
-
SHA1
33a5953fbcce8761af1e68df9c9f4ad153c4a536
-
SHA256
f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05
-
SHA512
a81631eef6163f437e5bdf83156d26856653411dc6b9becc5580a83b9a4123faec5855d625beec15b1f71c3155624187f776f56b4f58e5f87e9f39bd8b61ba88
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
pid Process 1964 wdcvist 3504 wdcvist 816 wdcvist 4032 wdcvist 3988 wdcvist 696 wdcvist -
Deletes itself 1 IoCs
pid Process 3052 Process not Found -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 636 set thread context of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 1964 set thread context of 3504 1964 wdcvist 80 PID 816 set thread context of 4032 816 wdcvist 82 PID 3988 set thread context of 696 3988 wdcvist 84 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wdcvist Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06a029882deabf229f62728afe3baf4f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2500 06a029882deabf229f62728afe3baf4f.exe 2500 06a029882deabf229f62728afe3baf4f.exe 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3052 Process not Found -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2500 06a029882deabf229f62728afe3baf4f.exe 3504 wdcvist 696 wdcvist -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3052 Process not Found -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 636 wrote to memory of 2500 636 06a029882deabf229f62728afe3baf4f.exe 75 PID 1964 wrote to memory of 3504 1964 wdcvist 80 PID 1964 wrote to memory of 3504 1964 wdcvist 80 PID 1964 wrote to memory of 3504 1964 wdcvist 80 PID 1964 wrote to memory of 3504 1964 wdcvist 80 PID 1964 wrote to memory of 3504 1964 wdcvist 80 PID 1964 wrote to memory of 3504 1964 wdcvist 80 PID 816 wrote to memory of 4032 816 wdcvist 82 PID 816 wrote to memory of 4032 816 wdcvist 82 PID 816 wrote to memory of 4032 816 wdcvist 82 PID 816 wrote to memory of 4032 816 wdcvist 82 PID 816 wrote to memory of 4032 816 wdcvist 82 PID 816 wrote to memory of 4032 816 wdcvist 82 PID 3988 wrote to memory of 696 3988 wdcvist 84 PID 3988 wrote to memory of 696 3988 wdcvist 84 PID 3988 wrote to memory of 696 3988 wdcvist 84 PID 3988 wrote to memory of 696 3988 wdcvist 84 PID 3988 wrote to memory of 696 3988 wdcvist 84 PID 3988 wrote to memory of 696 3988 wdcvist 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"C:\Users\Admin\AppData\Local\Temp\06a029882deabf229f62728afe3baf4f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2500
-
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3504
-
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4032
-
-
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Roaming\wdcvistC:\Users\Admin\AppData\Roaming\wdcvist2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:696
-