Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/02/2023, 19:19
Static task
static1
Behavioral task
behavioral1
Sample
SMGS.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SMGS.exe
Resource
win10v2004-20220812-en
General
-
Target
SMGS.exe
-
Size
4.8MB
-
MD5
973d6bb15efd90c87c861bb50682b4e0
-
SHA1
6be806023c19d7b332118bdc60ec2cabf4afd7a7
-
SHA256
464bf35525b6f482b91e5a1ba287c58304e7c41558c8070e42bdaa19769b5b05
-
SHA512
02355d9053c02c7470cdf6bde0a7d30ddf8a15a98c70dedf67a44639db3f92f1f961cb887e262b91eaeaeeef406e83c1294c690165afe2d7b50bae2e13896237
-
SSDEEP
24576:VBgHFLM9d5M7WbzMdMp+5R6hIONsEQ/xWxPNnb1T/d+BIPFsKmQhhEG6veOSV1jF:
Malware Config
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1952-55-0x0000000006180000-0x00000000063E6000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zzycvoloo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nqtsofal\\Zzycvoloo.exe\"" SMGS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 828 powershell.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe 1952 SMGS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1952 SMGS.exe Token: SeDebugPrivilege 828 powershell.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1952 wrote to memory of 828 1952 SMGS.exe 28 PID 1952 wrote to memory of 828 1952 SMGS.exe 28 PID 1952 wrote to memory of 828 1952 SMGS.exe 28 PID 1952 wrote to memory of 828 1952 SMGS.exe 28 PID 1952 wrote to memory of 1700 1952 SMGS.exe 30 PID 1952 wrote to memory of 1700 1952 SMGS.exe 30 PID 1952 wrote to memory of 1700 1952 SMGS.exe 30 PID 1952 wrote to memory of 1700 1952 SMGS.exe 30 PID 1952 wrote to memory of 1176 1952 SMGS.exe 31 PID 1952 wrote to memory of 1176 1952 SMGS.exe 31 PID 1952 wrote to memory of 1176 1952 SMGS.exe 31 PID 1952 wrote to memory of 1176 1952 SMGS.exe 31 PID 1952 wrote to memory of 1144 1952 SMGS.exe 32 PID 1952 wrote to memory of 1144 1952 SMGS.exe 32 PID 1952 wrote to memory of 1144 1952 SMGS.exe 32 PID 1952 wrote to memory of 1144 1952 SMGS.exe 32 PID 1952 wrote to memory of 564 1952 SMGS.exe 33 PID 1952 wrote to memory of 564 1952 SMGS.exe 33 PID 1952 wrote to memory of 564 1952 SMGS.exe 33 PID 1952 wrote to memory of 564 1952 SMGS.exe 33 PID 1952 wrote to memory of 888 1952 SMGS.exe 34 PID 1952 wrote to memory of 888 1952 SMGS.exe 34 PID 1952 wrote to memory of 888 1952 SMGS.exe 34 PID 1952 wrote to memory of 888 1952 SMGS.exe 34 PID 1952 wrote to memory of 1084 1952 SMGS.exe 35 PID 1952 wrote to memory of 1084 1952 SMGS.exe 35 PID 1952 wrote to memory of 1084 1952 SMGS.exe 35 PID 1952 wrote to memory of 1084 1952 SMGS.exe 35 PID 1952 wrote to memory of 1436 1952 SMGS.exe 36 PID 1952 wrote to memory of 1436 1952 SMGS.exe 36 PID 1952 wrote to memory of 1436 1952 SMGS.exe 36 PID 1952 wrote to memory of 1436 1952 SMGS.exe 36 PID 1952 wrote to memory of 908 1952 SMGS.exe 37 PID 1952 wrote to memory of 908 1952 SMGS.exe 37 PID 1952 wrote to memory of 908 1952 SMGS.exe 37 PID 1952 wrote to memory of 908 1952 SMGS.exe 37 PID 1952 wrote to memory of 892 1952 SMGS.exe 38 PID 1952 wrote to memory of 892 1952 SMGS.exe 38 PID 1952 wrote to memory of 892 1952 SMGS.exe 38 PID 1952 wrote to memory of 892 1952 SMGS.exe 38 PID 1952 wrote to memory of 336 1952 SMGS.exe 39 PID 1952 wrote to memory of 336 1952 SMGS.exe 39 PID 1952 wrote to memory of 336 1952 SMGS.exe 39 PID 1952 wrote to memory of 336 1952 SMGS.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exe"C:\Users\Admin\AppData\Local\Temp\SMGS.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:1176
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:1144
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:564
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:888
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:1084
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:1436
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\SMGS.exeC:\Users\Admin\AppData\Local\Temp\SMGS.exe2⤵PID:336
-