Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 01:45
Static task
static1
Behavioral task
behavioral1
Sample
2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe
Resource
win10v2004-20221111-en
General
-
Target
2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe
-
Size
341KB
-
MD5
56136c8191e785dea3bc289f2717a1bf
-
SHA1
c4c9a4c87d12ed29aaa01595be8ae87325e17f22
-
SHA256
2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e
-
SHA512
e599e4dec67181718ff7f46136b0d72bfc9f86d51f315033f9630009e0fc5931b0d46f23230eafa090bf9542f09fa5dda980f357e0115c72bb41880f0f5fc3dc
-
SSDEEP
6144:g4oO+HndglPIw4NRHJcqJnMW2RqnrpxwsY:g4oOkgqw4N3cqtMW3dxvY
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/4208-133-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
pid Process 1904 vufebev -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vufebev Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vufebev Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vufebev Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4208 2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe 4208 2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found 2688 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2688 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4208 2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe 1904 vufebev
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe"C:\Users\Admin\AppData\Local\Temp\2eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4208
-
C:\Users\Admin\AppData\Roaming\vufebevC:\Users\Admin\AppData\Roaming\vufebev1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
341KB
MD556136c8191e785dea3bc289f2717a1bf
SHA1c4c9a4c87d12ed29aaa01595be8ae87325e17f22
SHA2562eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e
SHA512e599e4dec67181718ff7f46136b0d72bfc9f86d51f315033f9630009e0fc5931b0d46f23230eafa090bf9542f09fa5dda980f357e0115c72bb41880f0f5fc3dc
-
Filesize
341KB
MD556136c8191e785dea3bc289f2717a1bf
SHA1c4c9a4c87d12ed29aaa01595be8ae87325e17f22
SHA2562eb13acad4f690ccb634976072d6cc694ca7642ef373e8554031511bfbebca9e
SHA512e599e4dec67181718ff7f46136b0d72bfc9f86d51f315033f9630009e0fc5931b0d46f23230eafa090bf9542f09fa5dda980f357e0115c72bb41880f0f5fc3dc