Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    85s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/09/2022, 04:09

General

  • Target

    c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829.exe

  • Size

    267KB

  • MD5

    51b8c675a784d9fd6257f1db51a28624

  • SHA1

    ec8c5b8e3181065ed7a3ca1c5a836a8dce1b6631

  • SHA256

    c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829

  • SHA512

    fb273c61a1fa56738ce10f8d642efc7da6dd90022afe0203019e1c7e4df67bd2af5f803f7cb9ca8d19f6a6316c250cb05ed05ed3bd01046b86084bb3ffbf385c

  • SSDEEP

    6144:4sxqFaeR195lHlxc8JTooPs/p+MtZq9L:Xq5195pHc8JTooPskMt

Malware Config

Signatures

  • Detects Smokeloader packer 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829.exe
    "C:\Users\Admin\AppData\Local\Temp\c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\Temp\c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829.exe
      "C:\Users\Admin\AppData\Local\Temp\c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3892
  • C:\Users\Admin\AppData\Roaming\sregjjd
    C:\Users\Admin\AppData\Roaming\sregjjd
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Roaming\sregjjd
      C:\Users\Admin\AppData\Roaming\sregjjd
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:3404

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\sregjjd

    Filesize

    267KB

    MD5

    51b8c675a784d9fd6257f1db51a28624

    SHA1

    ec8c5b8e3181065ed7a3ca1c5a836a8dce1b6631

    SHA256

    c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829

    SHA512

    fb273c61a1fa56738ce10f8d642efc7da6dd90022afe0203019e1c7e4df67bd2af5f803f7cb9ca8d19f6a6316c250cb05ed05ed3bd01046b86084bb3ffbf385c

  • C:\Users\Admin\AppData\Roaming\sregjjd

    Filesize

    267KB

    MD5

    51b8c675a784d9fd6257f1db51a28624

    SHA1

    ec8c5b8e3181065ed7a3ca1c5a836a8dce1b6631

    SHA256

    c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829

    SHA512

    fb273c61a1fa56738ce10f8d642efc7da6dd90022afe0203019e1c7e4df67bd2af5f803f7cb9ca8d19f6a6316c250cb05ed05ed3bd01046b86084bb3ffbf385c

  • C:\Users\Admin\AppData\Roaming\sregjjd

    Filesize

    267KB

    MD5

    51b8c675a784d9fd6257f1db51a28624

    SHA1

    ec8c5b8e3181065ed7a3ca1c5a836a8dce1b6631

    SHA256

    c072fe24046a3228661e3ae9b96fce4e39dab53f058b62e944cac3c58c1b5829

    SHA512

    fb273c61a1fa56738ce10f8d642efc7da6dd90022afe0203019e1c7e4df67bd2af5f803f7cb9ca8d19f6a6316c250cb05ed05ed3bd01046b86084bb3ffbf385c

  • memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-141-0x00000000007F0000-0x000000000089E000-memory.dmp

    Filesize

    696KB

  • memory/2584-142-0x00000000001D0000-0x00000000001D9000-memory.dmp

    Filesize

    36KB

  • memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3404-242-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3892-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-147-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3892-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-169-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3892-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/3892-179-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/4864-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-187-0x0000000077A40000-0x0000000077BCE000-memory.dmp

    Filesize

    1.6MB

  • memory/4864-220-0x0000000000B76000-0x0000000000B86000-memory.dmp

    Filesize

    64KB