Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
69s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
06/12/2022, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe
Resource
win10-20220901-en
General
-
Target
0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe
-
Size
320KB
-
MD5
3169421c73b9099cacfd5c5b75df237b
-
SHA1
bf788fe4de2df592b2507e0fc3a065e309f50b5c
-
SHA256
0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824
-
SHA512
5a3b940d51336969eda4ac28926c6d24b6864ae4ebbea370a4fcc0db5c03966c261ebee61da5215ee0ad7382bb7bcdcee83b17c3eba0d7417be1485c7ecc48ad
-
SSDEEP
3072:iU8XI4dVNBy+HGq9L2R7T8xB5ak4SFjOeeygDVmn6tb64mbB2z0TNsPp2KidhJd5:EbNBy+/L21T8xetx7InvbBRTpF
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
resource yara_rule behavioral1/memory/2108-132-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader behavioral1/memory/2428-149-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2428-150-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/2428-164-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/2428-181-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3064 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2108 set thread context of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2428 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 2428 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found 3064 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3064 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2428 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66 PID 2108 wrote to memory of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66 PID 2108 wrote to memory of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66 PID 2108 wrote to memory of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66 PID 2108 wrote to memory of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66 PID 2108 wrote to memory of 2428 2108 0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe"C:\Users\Admin\AppData\Local\Temp\0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe"C:\Users\Admin\AppData\Local\Temp\0f92b27823ea34c606c0fcfd3ff187f2dcddf48eb374864d396f5fd9928e9824.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2428
-