Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17/09/2022, 20:03

General

  • Target

    1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe

  • Size

    291KB

  • MD5

    362101cc9247e703d2fd75f87a38273f

  • SHA1

    d473e1b1f8c46e314321b1766cc2418065fbb6ec

  • SHA256

    1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a

  • SHA512

    6b0973fa2c9feb3fe5655ee7df053f849f53a6da0d013104ff472b670156d376f4dd65e305567b3e415c50e0d3ba258a565e099d30396d581bd7c07536fc3180

  • SSDEEP

    3072:WXLDHO0YD67LFw7TCsueg5I1rH2vlg8Bth2dOkOQ0K6wwtgKM/h3BsxkgaBChU/x:+ye7LK7TdRrGTQZOQ03ZnigabwVf+

Malware Config

Signatures

  • Detects Smokeloader packer 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe
    "C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe
      "C:\Users\Admin\AppData\Local\Temp\1da1751a7d92b95aa405f39ff52b944729729d450efda568c6a340aee8373b0a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/376-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-182-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/376-181-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-180-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-175-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-159-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/376-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-148-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/376-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/376-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-152-0x00000000005CA000-0x00000000005DA000-memory.dmp

    Filesize

    64KB

  • memory/2300-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-153-0x00000000001E0000-0x00000000001E9000-memory.dmp

    Filesize

    36KB

  • memory/2300-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2300-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB