Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29/12/2022, 12:22
General
-
Target
7d06e1398824ce24db20af1e5de6eae8.exe
-
Size
301KB
-
MD5
7d06e1398824ce24db20af1e5de6eae8
-
SHA1
fb01ccd6b557431d46278ea95ff13c3ec58ae6c5
-
SHA256
fbbeaa1e952007ae67e981d3ba3b282e260dba293a2250a7756c2ba4f27ba3aa
-
SHA512
d03bd3c16dc992a252e367b76c7b9e963ab11c13b90bf4adb457f4195fb23511b9fbb5c11612bd08a536aba20ad5bee65d526bde62d5a62bc28095ea07d4eeee
-
SSDEEP
6144:5+U5mLNpGWZedB+Aqxro2yiw7n1HbwZoV9J:rwB4WYcAsZw7
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d06e1398824ce24db20af1e5de6eae8.exe"C:\Users\Admin\AppData\Local\Temp\7d06e1398824ce24db20af1e5de6eae8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F002.exeC:\Users\Admin\AppData\Local\Temp\F002.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qfyshwqueqdpai.tmp",Dioeeedresq2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 140263⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 4722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2928 -ip 29281⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\google\temp\s_shared_multi_filetype.dll",OwwvZzQ=2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD5cc4076892624e73648aecd5bc94dc8f1
SHA198702973bbafd6bb645fece1b19f3801304392c2
SHA2569267492278a426fb8912f019f5854f8bcc19ce01ac914c28e9e784f1d78fec81
SHA5124202440d0aee5b6a103d8fe4eab1af63ac763603b3c78671eee99dee7675f86fedccc770e4bba397385937e59851e45e2f7eeda025783408f065075490aa22af
-
Filesize
792KB
MD5cc4076892624e73648aecd5bc94dc8f1
SHA198702973bbafd6bb645fece1b19f3801304392c2
SHA2569267492278a426fb8912f019f5854f8bcc19ce01ac914c28e9e784f1d78fec81
SHA5124202440d0aee5b6a103d8fe4eab1af63ac763603b3c78671eee99dee7675f86fedccc770e4bba397385937e59851e45e2f7eeda025783408f065075490aa22af
-
Filesize
10KB
MD5220ae72aa2505c9276da2056b7e34936
SHA16dfb0f4fd5c0d25062d3d1235fc20358560fdb89
SHA256afc37ba57fac36ba151953b67619dbbb985f58122f4ebe07f15b312b5bdf004c
SHA512cab8485458b9870015f037fc6c8279018bf212d36ba01181bdb90970473a4b5aaeb9708e36eb21c8e6c1301dbdca630b29c8b3a6fa82fa14fb04bc65d235debd
-
Filesize
3.5MB
MD5defc6e315c1a4999ad9bef9dc2a7d21a
SHA132caf8d0e6d3e8ae90da549139289a4582d8d89e
SHA25630d76a9cdb10b372cb1e8267ffa96d9112461acaca0c0ef11da64e19e0c5041b
SHA5122bed1af9ca4edd7c896b81aac7c9a84dbc1710872281256b751035bc36e0f239792ece32b4b2ed17f1c92c7e921f5b674992bf6295db3ed429ce13f1d1e926e3
-
Filesize
3.5MB
MD5defc6e315c1a4999ad9bef9dc2a7d21a
SHA132caf8d0e6d3e8ae90da549139289a4582d8d89e
SHA25630d76a9cdb10b372cb1e8267ffa96d9112461acaca0c0ef11da64e19e0c5041b
SHA5122bed1af9ca4edd7c896b81aac7c9a84dbc1710872281256b751035bc36e0f239792ece32b4b2ed17f1c92c7e921f5b674992bf6295db3ed429ce13f1d1e926e3
-
Filesize
28KB
MD54bee7862d96900a7b0f20d709ffe5af2
SHA159f4073ff756ee74e83e5d9448e7d6da69f3bf08
SHA256526cb82e083378ccc1a5465f3250f40f9e74bdbc65c58ab9210fc8a88b273e63
SHA512ee0f19e4aa0006b4da4b16522eea9774c09b07d6fae3529992df7f5f47ee1fa49a6ec5b77370be594762ec63f1f6aee4be139e44f2f369f5590777cf95d9be31
-
Filesize
7KB
MD5e585657cf3525fd22dad5e2409eb9e60
SHA11c0b9d97bb93098e1d8a162b9725a0d6134dc913
SHA256581fd3d9aa551599bd691b5b23cdc51c48f7f3a65955adf1e1d0fef0a8cfb8b8
SHA512601c03a19bb0d1170db8c3a05ff4a38d209e2ec53426b2048362504b75e3971f40480afd118cd741a52e69ba5a55c61dd4cc488f335be3d67584982009392ced
-
Filesize
3KB
MD5701beb4f8c252fb3c9f5dbdc94648048
SHA1556ba20475a502b68b7992454be6c64ab355b4ec
SHA256620e27a3746773947ba7ceee99d2b55e4e3cfa32a9164a0185a8cb8b22a55b67
SHA51228c76c3d5ebb75797d37965b13cb05f852e25cc3d2558c38b091b82e12b78f268d58f144a0fcac32b30d70e5897ed7c647d4e3584edd2625ba7cdf5c54826faf
-
Filesize
53B
MD56b5c875287b25d64563bd7c830621b66
SHA1df0c4dcbbf3ce6706cae126955b4fcb88be0694a
SHA2569d45f7e6114d2088ab05423697cafedc0a9926f785358cb2faddc4f1e45b193d
SHA512608b92078a9082b4bfe2b066891127713cfd4329d8b26a3747b672c19e41e25242f60153517227a04a3f2b355805584cd4fe2f2dece45b1cd5dfc814a486d229
-
Filesize
1.1MB
MD554e4da5b4f70e860806c6453cb9af849
SHA11da5cb24149011684811df7e841b11341f0ec2cc
SHA256c52eaa66f05cbf87779feb3036a295c2b146f56ada659c656e54f7143b506ae0
SHA512dc3b02a9ad375c14e561f12d366122e0050930c0fe978f0e4da8ddadf46d9360cb4921d681a6c5c29015ad5ee8c5130675a106469074547a88deaa6c9118f354
-
Filesize
1.1MB
MD554e4da5b4f70e860806c6453cb9af849
SHA11da5cb24149011684811df7e841b11341f0ec2cc
SHA256c52eaa66f05cbf87779feb3036a295c2b146f56ada659c656e54f7143b506ae0
SHA512dc3b02a9ad375c14e561f12d366122e0050930c0fe978f0e4da8ddadf46d9360cb4921d681a6c5c29015ad5ee8c5130675a106469074547a88deaa6c9118f354
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5822d3ead416a1a85cb96e65f65cd5ae2
SHA1af32b69e2835d1cacdadb97ae6dfafccc32d1837
SHA25672bdb3a06dca8458ac9aedf06785b2d7b95a19f8b9f3f8f5be2eb4744e9c5d1d
SHA51248d0d61efd51fd2d8eb04d990b4a5b3ca34c916199d3b0a3b135d2089e028ee37f5145e4705fb75da77eaabbe12f8c4ea55775a41e1b1c68a90ce68b8c2a7260
-
Filesize
792KB
MD5cc4076892624e73648aecd5bc94dc8f1
SHA198702973bbafd6bb645fece1b19f3801304392c2
SHA2569267492278a426fb8912f019f5854f8bcc19ce01ac914c28e9e784f1d78fec81
SHA5124202440d0aee5b6a103d8fe4eab1af63ac763603b3c78671eee99dee7675f86fedccc770e4bba397385937e59851e45e2f7eeda025783408f065075490aa22af
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
856KB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.6MB
-
Filesize
2.7MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.4MB
-
Filesize
11.4MB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
316KB
-
Filesize
316KB