Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/09/2022, 11:48

General

  • Target

    ecf505c4260349befe0e6e52e560c5f1a6fdb4785cfb8c5201c9a91914447747.exe

  • Size

    266KB

  • MD5

    420f55d4c76e1359ce3c2a00957e845c

  • SHA1

    db006a9bf29e158bec6eb9c80f4bb7bdd2e6d56f

  • SHA256

    ecf505c4260349befe0e6e52e560c5f1a6fdb4785cfb8c5201c9a91914447747

  • SHA512

    70d157a772602088d0442b6cce4befcfbbeff61c0238272669bccea667fa9d81862ee3012f77a94c7c51dc563eed134e7c4763e61c3612d5fdae743e30ba0924

  • SSDEEP

    3072:sXH5ZONbFA5IL58xQs37d4fbSXexu+hkMdTVJJ0KheHUltM/h3BsxkgaBChU6e:oSbTL654fbSOo+SoDJ00eutniga

Malware Config

Signatures

  • Detects Smokeloader packer 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecf505c4260349befe0e6e52e560c5f1a6fdb4785cfb8c5201c9a91914447747.exe
    "C:\Users\Admin\AppData\Local\Temp\ecf505c4260349befe0e6e52e560c5f1a6fdb4785cfb8c5201c9a91914447747.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1892
    • C:\Users\Admin\AppData\Local\Temp\ecf505c4260349befe0e6e52e560c5f1a6fdb4785cfb8c5201c9a91914447747.exe
      "C:\Users\Admin\AppData\Local\Temp\ecf505c4260349befe0e6e52e560c5f1a6fdb4785cfb8c5201c9a91914447747.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4724

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1892-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-142-0x0000000000728000-0x0000000000739000-memory.dmp

    Filesize

    68KB

  • memory/1892-143-0x00000000005B0000-0x00000000005B9000-memory.dmp

    Filesize

    36KB

  • memory/1892-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/1892-149-0x0000000000728000-0x0000000000739000-memory.dmp

    Filesize

    68KB

  • memory/4724-145-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/4724-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-153-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-158-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/4724-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-175-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4724-178-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB