Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30/11/2022, 23:24
Static task
static1
Behavioral task
behavioral1
Sample
a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe
-
Size
185KB
-
MD5
9982b0a8d90b18757a8b8483157534ec
-
SHA1
84b853cd02009f403666cf06a98af656a99561ee
-
SHA256
a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf
-
SHA512
33f6b28b4b5b240b68ee099f00779f6b5121c04974cf946bf3e2c34a0d0ca264bd186268769349167d1eecf5f2f8ba267829a2cafe0971e4ef4451f541f80e78
-
SSDEEP
3072:1V6MZT1A0rQhkMn5zJrQeTkvpKgBeenIdKRw+6ODNG:/6MlrQhMeT6BBad+Mu
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 4 IoCs
resource yara_rule behavioral1/memory/1924-133-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/3528-135-0x00000000005F0000-0x00000000005F9000-memory.dmp family_smokeloader behavioral1/memory/1924-136-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/1924-137-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3528 set thread context of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 1924 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found 1032 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1032 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1924 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 1032 Process not Found Token: SeCreatePagefilePrivilege 1032 Process not Found Token: SeShutdownPrivilege 1032 Process not Found Token: SeCreatePagefilePrivilege 1032 Process not Found Token: SeShutdownPrivilege 1032 Process not Found Token: SeCreatePagefilePrivilege 1032 Process not Found Token: SeShutdownPrivilege 1032 Process not Found Token: SeCreatePagefilePrivilege 1032 Process not Found Token: SeShutdownPrivilege 1032 Process not Found Token: SeCreatePagefilePrivilege 1032 Process not Found Token: SeShutdownPrivilege 1032 Process not Found Token: SeCreatePagefilePrivilege 1032 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1032 Process not Found 1032 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3528 wrote to memory of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84 PID 3528 wrote to memory of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84 PID 3528 wrote to memory of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84 PID 3528 wrote to memory of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84 PID 3528 wrote to memory of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84 PID 3528 wrote to memory of 1924 3528 a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe"C:\Users\Admin\AppData\Local\Temp\a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe"C:\Users\Admin\AppData\Local\Temp\a53ef8a03d2c46a1ac561df27098947d38f248f31f4f05bcc98e1c327586e9bf.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1924
-