Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/03/2023, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe
Resource
win10v2004-20230220-en
General
-
Target
2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe
-
Size
291KB
-
MD5
ae4bbdec91eba4871eee93ac61410cb6
-
SHA1
abab472cf9573513955898956c0e07bcd8807b9c
-
SHA256
2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf
-
SHA512
e2f2f405f790bfa406311c6d43105d80b3d4ad809690d7da8a678f46c02d3ceda7868e854110e32e3d178626fefd27fe1a243335e36fdab60d55f2f492ab8c24
-
SSDEEP
3072:T5xCowcLLxW3JUMnFG+6K8azyIfvTIfgDGJRn5EnttGr:TvwcLLw3JbGtKJzyIfLIfgq32/Gr
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 936 2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe 936 2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found 1288 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1288 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 936 2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1288 Process not Found 1288 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1288 Process not Found 1288 Process not Found
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe"C:\Users\Admin\AppData\Local\Temp\2a72d40fba2ce267e0996604bab63c1d7c9380229fc5788c381b3089723d26cf.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:936