Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05/01/2023, 23:09
General
-
Target
file.exe
-
Size
212KB
-
MD5
28900a37a284467d9f9a0769105cedc4
-
SHA1
12f1fd222b75aa3effa9e4ef17b74d9b5affc979
-
SHA256
5465e10d6534d16d2ca844714d0f03da4f78fa1726252f32f54c436fcd6145b4
-
SHA512
f64a1d9815176e2892d2513b0740604b3850a10ccbc4e31ca3f5cadc929f21073de3f35ba0bbb40cf1b5097c5527ca29c0dd8e578daaa1fc884d0c4ba0c084c4
-
SSDEEP
3072:O0XhY7SvLCGxJDhniq+R5z5BqDHWbORdzh9EOl7T4/Cvk:OwlLCGx7i9R52rbdvR
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 30 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FEF6.exeC:\Users\Admin\AppData\Local\Temp\FEF6.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Rewurtuihyfrtty.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141183⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 4802⤵
- Program crash
-
-
C:\Users\Admin\AppData\Roaming\shesurbC:\Users\Admin\AppData\Roaming\shesurb1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4624 -ip 46241⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
MD5e7c4f8fa014ac2eb81c2d4368ed28953
SHA1f6dcfaab307479cad7b03624b26474e5eccee5f3
SHA256cd2c2cd15f57ed2f6ff4a8e431fab91b541515ac5d2596e186a90190d445dff2
SHA51259f8bb582ed2f09f4c08aa5f824407f0e1b20186071e859c897230902e7bf9aaf6e620bcd8c302ca4bbace4229b4bd801622d254344ba065e95be26ebd40ccd6
-
Filesize
3.7MB
MD5e7c4f8fa014ac2eb81c2d4368ed28953
SHA1f6dcfaab307479cad7b03624b26474e5eccee5f3
SHA256cd2c2cd15f57ed2f6ff4a8e431fab91b541515ac5d2596e186a90190d445dff2
SHA51259f8bb582ed2f09f4c08aa5f824407f0e1b20186071e859c897230902e7bf9aaf6e620bcd8c302ca4bbace4229b4bd801622d254344ba065e95be26ebd40ccd6
-
Filesize
4.3MB
MD50cf33e9defed769e99bb375480518d07
SHA1099b8b21a8f6fec81789ce033b39d693d6732d85
SHA25666d881b9e631d9e8b645dd88129c786dceca1c3bf0cd7ef444157415a59e7a98
SHA5125103c63508d3630aa8a9cd0d5fb1dc79dc62f67585e5dce311e190099ad66cd1a9ebf5eb17076ec1b5efd235e2b3c5f5340b8689cecfecfa6cfc77f31dce2a1c
-
Filesize
4.3MB
MD50cf33e9defed769e99bb375480518d07
SHA1099b8b21a8f6fec81789ce033b39d693d6732d85
SHA25666d881b9e631d9e8b645dd88129c786dceca1c3bf0cd7ef444157415a59e7a98
SHA5125103c63508d3630aa8a9cd0d5fb1dc79dc62f67585e5dce311e190099ad66cd1a9ebf5eb17076ec1b5efd235e2b3c5f5340b8689cecfecfa6cfc77f31dce2a1c
-
Filesize
4.3MB
MD50cf33e9defed769e99bb375480518d07
SHA1099b8b21a8f6fec81789ce033b39d693d6732d85
SHA25666d881b9e631d9e8b645dd88129c786dceca1c3bf0cd7ef444157415a59e7a98
SHA5125103c63508d3630aa8a9cd0d5fb1dc79dc62f67585e5dce311e190099ad66cd1a9ebf5eb17076ec1b5efd235e2b3c5f5340b8689cecfecfa6cfc77f31dce2a1c
-
Filesize
212KB
MD528900a37a284467d9f9a0769105cedc4
SHA112f1fd222b75aa3effa9e4ef17b74d9b5affc979
SHA2565465e10d6534d16d2ca844714d0f03da4f78fa1726252f32f54c436fcd6145b4
SHA512f64a1d9815176e2892d2513b0740604b3850a10ccbc4e31ca3f5cadc929f21073de3f35ba0bbb40cf1b5097c5527ca29c0dd8e578daaa1fc884d0c4ba0c084c4
-
Filesize
212KB
MD528900a37a284467d9f9a0769105cedc4
SHA112f1fd222b75aa3effa9e4ef17b74d9b5affc979
SHA2565465e10d6534d16d2ca844714d0f03da4f78fa1726252f32f54c436fcd6145b4
SHA512f64a1d9815176e2892d2513b0740604b3850a10ccbc4e31ca3f5cadc929f21073de3f35ba0bbb40cf1b5097c5527ca29c0dd8e578daaa1fc884d0c4ba0c084c4
-
Filesize
39.6MB
-
Filesize
39.6MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.5MB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
11.5MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
11.5MB
-
Filesize
4.3MB
-
Filesize
11.5MB
-
Filesize
2.7MB
-
Filesize
2.6MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.5MB
-
Filesize
43.1MB
-
Filesize
43.1MB
-
Filesize
4.9MB
-
Filesize
43.1MB
-
Filesize
64KB
-
Filesize
39.6MB
-
Filesize
39.6MB
-
Filesize
36KB