Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
03/02/2023, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe
Resource
win10-20220901-en
General
-
Target
3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe
-
Size
192KB
-
MD5
56bdc23d86e6770e67c505f36951f86d
-
SHA1
c66da8b54d71e667b486d1d48d3a52600f1d8a56
-
SHA256
3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2
-
SHA512
19dbba701f7b3f6dd14de5d4fe98989903a2ed7e813cc5542cd460e628aa9fe0bab5ea644787c23d7fc2eff80e35df21f07a7ee56d39dc04e45a737c1c44be26
-
SSDEEP
3072:6WLPGXwMqLoGg/AsWle5Tt4D2kokJljvZ3TwTtRkTwVty7B+9Ym:6W0qL7gYsJE2knGTtOTI6BcYm
Malware Config
Signatures
-
Detects Smokeloader packer 5 IoCs
resource yara_rule behavioral1/memory/2656-145-0x0000000000710000-0x0000000000719000-memory.dmp family_smokeloader behavioral1/memory/4120-149-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4120-150-0x0000000000402DD8-mapping.dmp family_smokeloader behavioral1/memory/4120-161-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral1/memory/4120-182-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 2412 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2656 set thread context of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4120 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 4120 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found 2412 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4120 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2412 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2412 Process not Found -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2656 wrote to memory of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66 PID 2656 wrote to memory of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66 PID 2656 wrote to memory of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66 PID 2656 wrote to memory of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66 PID 2656 wrote to memory of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66 PID 2656 wrote to memory of 4120 2656 3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe"C:\Users\Admin\AppData\Local\Temp\3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe"C:\Users\Admin\AppData\Local\Temp\3a7e2c38496116c8ae8bb719405111b77e7dfdf7399d8550b4dec522a601fac2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4120
-