Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
19/09/2022, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe
Resource
win10-20220812-en
General
-
Target
ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe
-
Size
146KB
-
MD5
779edc74c2d8626172496c85b05c47d9
-
SHA1
1b87f878cf74a13aba1017e3fdccf98b6a72b687
-
SHA256
ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32
-
SHA512
4f8160dc3d807f60d03058d20a41fcb4772789a828a474a152b1514931704ab28cafec7e2591c8a9708b535ec543c1cfcce70d7b73ca1abe9ab4e54a69ff09ed
-
SSDEEP
3072:zD3kiLsz5Yb3utwYLv8P3xeyVs3fQZiBDMpLx:FLs63uqYs+vK2
Malware Config
Signatures
-
Detects Smokeloader packer 7 IoCs
resource yara_rule behavioral1/memory/1744-136-0x0000000000710000-0x0000000000719000-memory.dmp family_smokeloader behavioral1/memory/3772-146-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3772-147-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/3772-161-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3772-178-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2712-209-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/2712-241-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
pid Process 4220 wvfdaiw 2712 wvfdaiw -
Deletes itself 1 IoCs
pid Process 2480 Process not Found -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1744 set thread context of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 4220 set thread context of 2712 4220 wvfdaiw 68 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wvfdaiw Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wvfdaiw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI wvfdaiw -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 3772 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found 2480 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3772 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 2712 wvfdaiw -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2480 Process not Found Token: SeCreatePagefilePrivilege 2480 Process not Found -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1744 wrote to memory of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 1744 wrote to memory of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 1744 wrote to memory of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 1744 wrote to memory of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 1744 wrote to memory of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 1744 wrote to memory of 3772 1744 ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe 66 PID 4220 wrote to memory of 2712 4220 wvfdaiw 68 PID 4220 wrote to memory of 2712 4220 wvfdaiw 68 PID 4220 wrote to memory of 2712 4220 wvfdaiw 68 PID 4220 wrote to memory of 2712 4220 wvfdaiw 68 PID 4220 wrote to memory of 2712 4220 wvfdaiw 68 PID 4220 wrote to memory of 2712 4220 wvfdaiw 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe"C:\Users\Admin\AppData\Local\Temp\ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe"C:\Users\Admin\AppData\Local\Temp\ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3772
-
-
C:\Users\Admin\AppData\Roaming\wvfdaiwC:\Users\Admin\AppData\Roaming\wvfdaiw1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Roaming\wvfdaiwC:\Users\Admin\AppData\Roaming\wvfdaiw2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2712
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146KB
MD5779edc74c2d8626172496c85b05c47d9
SHA11b87f878cf74a13aba1017e3fdccf98b6a72b687
SHA256ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32
SHA5124f8160dc3d807f60d03058d20a41fcb4772789a828a474a152b1514931704ab28cafec7e2591c8a9708b535ec543c1cfcce70d7b73ca1abe9ab4e54a69ff09ed
-
Filesize
146KB
MD5779edc74c2d8626172496c85b05c47d9
SHA11b87f878cf74a13aba1017e3fdccf98b6a72b687
SHA256ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32
SHA5124f8160dc3d807f60d03058d20a41fcb4772789a828a474a152b1514931704ab28cafec7e2591c8a9708b535ec543c1cfcce70d7b73ca1abe9ab4e54a69ff09ed
-
Filesize
146KB
MD5779edc74c2d8626172496c85b05c47d9
SHA11b87f878cf74a13aba1017e3fdccf98b6a72b687
SHA256ffdbc622f7d18e41b2865d08163d93331eaee12c52d5cef4efb3897dc23ffa32
SHA5124f8160dc3d807f60d03058d20a41fcb4772789a828a474a152b1514931704ab28cafec7e2591c8a9708b535ec543c1cfcce70d7b73ca1abe9ab4e54a69ff09ed