Analysis

  • max time kernel
    188s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2022 06:34

General

  • Target

    jiigtih.exe

  • Size

    225KB

  • MD5

    85bf0a8fcb03c3f004e2e0a911c13aa9

  • SHA1

    b0796a57b47f6801f902f35f6a23d33666c4d773

  • SHA256

    dfe486574656d4f9290dc5b89c4c82f8dddd1090e812cae1e7d6a962888ee42b

  • SHA512

    3b0c83193d5ac53a28d0453bbf66d799644a6f3729bd9ffd41a186eecb51720639ed56e3ab9ae2aec789786d1c529957917997905b3fe711bcffe2ea76341159

  • SSDEEP

    3072:8XOBSkSSPL4sDEHan+smkP7VvsNA0C3eytzd/tN6qhgxXgTJCfU:44hLPLTEO+smkP7Vvsat3Rx/uoZ

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jiigtih.exe
    "C:\Users\Admin\AppData\Local\Temp\jiigtih.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1352-54-0x0000000075071000-0x0000000075073000-memory.dmp

    Filesize

    8KB

  • memory/1352-55-0x00000000008CA000-0x00000000008DF000-memory.dmp

    Filesize

    84KB

  • memory/1352-56-0x0000000000020000-0x0000000000029000-memory.dmp

    Filesize

    36KB

  • memory/1352-57-0x0000000000400000-0x000000000083C000-memory.dmp

    Filesize

    4.2MB

  • memory/1352-58-0x0000000000400000-0x000000000083C000-memory.dmp

    Filesize

    4.2MB