Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
17/10/2022, 23:55
Static task
static1
Behavioral task
behavioral1
Sample
92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe
Resource
win10-20220812-en
General
-
Target
92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe
-
Size
216KB
-
MD5
1dbadf056701ed2512fa120aa3e93f17
-
SHA1
6062ecfbe34dd89916ea21729202aab8589ba07f
-
SHA256
92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51
-
SHA512
681f00cc8f5c719c421b6af27f4bdd10bf3c93dd47385f16a8db98c1bc0d2cd3d3bcdc4a199bf55d8a200c8693b79728042f0d603da9ec6d217bec42c5d89ced
-
SSDEEP
3072:0WEShV4JjOEjyZmFoubLkEUpfeBFnkFL6feMhY4ZRJqgF6gct4OLOA:0HSkOZmnLklpWBU2dYCRb6gct4OLO
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
resource yara_rule behavioral1/memory/2656-145-0x00000000001E0000-0x00000000001E9000-memory.dmp family_smokeloader behavioral1/memory/3896-149-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3896-150-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/3896-159-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3896-181-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 2172 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2656 set thread context of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3896 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 3896 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found 2172 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3896 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2656 wrote to memory of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66 PID 2656 wrote to memory of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66 PID 2656 wrote to memory of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66 PID 2656 wrote to memory of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66 PID 2656 wrote to memory of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66 PID 2656 wrote to memory of 3896 2656 92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe"C:\Users\Admin\AppData\Local\Temp\92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe"C:\Users\Admin\AppData\Local\Temp\92d41f67ada5d715370f2972adcb0418919760199a7c6be6a44c0bd8fa350c51.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3896
-