Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/03/2023, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe
Resource
win10v2004-20230221-en
General
-
Target
f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe
-
Size
206KB
-
MD5
c71fe44880b57b069e6a6aa17a40f9e5
-
SHA1
21f523091d704b6024be3f270c06e716d27d246d
-
SHA256
f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f
-
SHA512
eef2d069abd301ed6a3b047d0fa5b4795e30ebc34309e1de6e057f7ad6fd01267a89b02978cf5fa855a348c96a86c899797a723d541b20dcc7d4b3999d709d09
-
SSDEEP
3072:24C8x2RySvUVDwaBQ3Onm3IdAECGFxlHed5huUaTaQIbDCPPjAXPSQ:bNxwySUZwaBQ3OB7FLgXHXKPj
Malware Config
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1360-55-0x0000000000220000-0x0000000000229000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1360 f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe 1360 f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found 1256 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1360 f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe"C:\Users\Admin\AppData\Local\Temp\f4280052008abdb62c26a27c61678350c57c70d726361cb8846ee126e83eaf0f.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1360