Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
12/04/2023, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe
Resource
win10v2004-20230221-en
General
-
Target
fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe
-
Size
351KB
-
MD5
0af623263a246bfb9b4fbeb46ae6f988
-
SHA1
349bab704498a9a356f4f16b345ac86f9bde8be7
-
SHA256
fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd
-
SHA512
8a912f624a690760c993f16632d61caf43c78dfc5ac913725c0ca7ef53ddf5489b9358647e44483a20d75ebbf9a3b99a49acf2ecc4f9cf1f7c49b1ab26644db4
-
SSDEEP
3072:1Upk2zswv7YoUT0J/AXdmQ/KHdBshUcuU8SG8cog4R+ahfOHEDZ0gDl62k6hSmAk:ek24GUTuCdmQ4Xsp0raxd10gp6ahSmN
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Extracted
vidar
3.4
e749025c61b2caca10aa829a9e1a65a1
https://steamcommunity.com/profiles/76561199494593681
https://t.me/auftriebs
-
profile_id_v2
e749025c61b2caca10aa829a9e1a65a1
-
user_agent
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Extracted
laplas
http://185.106.92.74
-
api_key
bc2dceabe69fa26dbf4dd8295d65e03e1990633a88c1c8410825c9266b239396
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 2664.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation 10485451091645853285.exe -
Executes dropped EXE 5 IoCs
pid Process 3264 2664.exe 596 65436289192140392288.exe 4352 10485451091645853285.exe 460 svcservice.exe 4628 auirsrs -
Loads dropped DLL 2 IoCs
pid Process 3264 2664.exe 3264 2664.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/files/0x0009000000023157-266.dat upx behavioral1/files/0x0009000000023157-269.dat upx behavioral1/files/0x0009000000023157-270.dat upx behavioral1/memory/596-271-0x0000000000F70000-0x0000000001DD3000-memory.dmp upx behavioral1/memory/596-272-0x0000000000F70000-0x0000000001DD3000-memory.dmp upx -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe" 10485451091645853285.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 4352 10485451091645853285.exe 4352 10485451091645853285.exe 460 svcservice.exe 460 svcservice.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2232 3264 WerFault.exe 92 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI auirsrs Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI auirsrs Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI auirsrs -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2664.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2664.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1528 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4640 fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe 4640 fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3192 Process not Found -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 4640 fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 3192 Process not Found 4628 auirsrs -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found Token: SeShutdownPrivilege 3192 Process not Found Token: SeCreatePagefilePrivilege 3192 Process not Found -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 3192 wrote to memory of 3264 3192 Process not Found 92 PID 3192 wrote to memory of 3264 3192 Process not Found 92 PID 3192 wrote to memory of 3264 3192 Process not Found 92 PID 3192 wrote to memory of 1104 3192 Process not Found 93 PID 3192 wrote to memory of 1104 3192 Process not Found 93 PID 3192 wrote to memory of 1104 3192 Process not Found 93 PID 3192 wrote to memory of 1104 3192 Process not Found 93 PID 3192 wrote to memory of 4276 3192 Process not Found 94 PID 3192 wrote to memory of 4276 3192 Process not Found 94 PID 3192 wrote to memory of 4276 3192 Process not Found 94 PID 3192 wrote to memory of 3796 3192 Process not Found 95 PID 3192 wrote to memory of 3796 3192 Process not Found 95 PID 3192 wrote to memory of 3796 3192 Process not Found 95 PID 3192 wrote to memory of 3796 3192 Process not Found 95 PID 3192 wrote to memory of 3984 3192 Process not Found 96 PID 3192 wrote to memory of 3984 3192 Process not Found 96 PID 3192 wrote to memory of 3984 3192 Process not Found 96 PID 3192 wrote to memory of 4280 3192 Process not Found 97 PID 3192 wrote to memory of 4280 3192 Process not Found 97 PID 3192 wrote to memory of 4280 3192 Process not Found 97 PID 3192 wrote to memory of 4280 3192 Process not Found 97 PID 3192 wrote to memory of 2236 3192 Process not Found 98 PID 3192 wrote to memory of 2236 3192 Process not Found 98 PID 3192 wrote to memory of 2236 3192 Process not Found 98 PID 3192 wrote to memory of 2236 3192 Process not Found 98 PID 3192 wrote to memory of 2588 3192 Process not Found 99 PID 3192 wrote to memory of 2588 3192 Process not Found 99 PID 3192 wrote to memory of 2588 3192 Process not Found 99 PID 3192 wrote to memory of 2588 3192 Process not Found 99 PID 3192 wrote to memory of 4392 3192 Process not Found 100 PID 3192 wrote to memory of 4392 3192 Process not Found 100 PID 3192 wrote to memory of 4392 3192 Process not Found 100 PID 3192 wrote to memory of 4272 3192 Process not Found 101 PID 3192 wrote to memory of 4272 3192 Process not Found 101 PID 3192 wrote to memory of 4272 3192 Process not Found 101 PID 3192 wrote to memory of 4272 3192 Process not Found 101 PID 3264 wrote to memory of 596 3264 2664.exe 102 PID 3264 wrote to memory of 596 3264 2664.exe 102 PID 596 wrote to memory of 4132 596 65436289192140392288.exe 104 PID 596 wrote to memory of 4132 596 65436289192140392288.exe 104 PID 4132 wrote to memory of 3020 4132 cmd.exe 106 PID 4132 wrote to memory of 3020 4132 cmd.exe 106 PID 3264 wrote to memory of 4352 3264 2664.exe 107 PID 3264 wrote to memory of 4352 3264 2664.exe 107 PID 3264 wrote to memory of 4352 3264 2664.exe 107 PID 3264 wrote to memory of 3812 3264 2664.exe 108 PID 3264 wrote to memory of 3812 3264 2664.exe 108 PID 3264 wrote to memory of 3812 3264 2664.exe 108 PID 3812 wrote to memory of 1528 3812 cmd.exe 111 PID 3812 wrote to memory of 1528 3812 cmd.exe 111 PID 3812 wrote to memory of 1528 3812 cmd.exe 111 PID 4352 wrote to memory of 460 4352 10485451091645853285.exe 113 PID 4352 wrote to memory of 460 4352 10485451091645853285.exe 113 PID 4352 wrote to memory of 460 4352 10485451091645853285.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe"C:\Users\Admin\AppData\Local\Temp\fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4640
-
C:\Users\Admin\AppData\Local\Temp\2664.exeC:\Users\Admin\AppData\Local\Temp\2664.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\ProgramData\65436289192140392288.exe"C:\ProgramData\65436289192140392288.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\65436289192140392288.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 04⤵PID:3020
-
-
-
-
C:\ProgramData\10485451091645853285.exe"C:\ProgramData\10485451091645853285.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:460
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2664.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:1528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3264 -s 18602⤵
- Program crash
PID:2232
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1104
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4276
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3796
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3984
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4280
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2236
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2588
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4392
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4272
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3264 -ip 32641⤵PID:3972
-
C:\Users\Admin\AppData\Roaming\auirsrsC:\Users\Admin\AppData\Roaming\auirsrs1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4628
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.2MB
MD5c5e0fb4ecaa8a7481a283099d604f7a0
SHA1df4b0c0cc823da2b0443076650c292b43dd9de33
SHA256c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
SHA512375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
Filesize
7.2MB
MD5c5e0fb4ecaa8a7481a283099d604f7a0
SHA1df4b0c0cc823da2b0443076650c292b43dd9de33
SHA256c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
SHA512375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
Filesize
7.2MB
MD5c5e0fb4ecaa8a7481a283099d604f7a0
SHA1df4b0c0cc823da2b0443076650c292b43dd9de33
SHA256c6c03e97c5de0c9eb264e4914d8c7f64d7e3528cc696f613e451a294262f3c42
SHA512375677d0cc802b09c7d1532d162a91a8eec4679f7639ef38dca9a9d3a03e20b3ab54707af7ffb138d00ec93ea4b34b6db0b33f365dc888ff9056c808a239bc57
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
4.3MB
MD5c4ab3149ef02a36d663699a8c541933e
SHA167088f5eff9ec575775b711c9e3650d12d7f4d5c
SHA2560a0fbd6af9e5d110118f02b87f9a92f9f58fb100f6d9883d55a6aae6c548b4ce
SHA51288b10f81b2cd273fefeffb4c2078807e89b4b756d50110b61e9f89092715f29ba8d1803f64bc971c1293dc624b92d0b7f05612ae661dd8d24e47d39047a4b7b4
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
471KB
MD5536700d1e209bd729d5c2eaa618edabc
SHA196b9c4d4070c8c2dc91080d423344f9ec4750359
SHA2567adfd6b9235ed112679159054cbce7e41fe6d31935bc33d5809510b2c5bbb7b0
SHA512e869104c4fb3bbd5528fce4b58ac1d35ccefca2950a2f8e2d2ccbab4d8fdc5103bad1db06c0f6e17922677b7680cdfe1b216c56f9d0074843f38d532f2520941
-
Filesize
471KB
MD5536700d1e209bd729d5c2eaa618edabc
SHA196b9c4d4070c8c2dc91080d423344f9ec4750359
SHA2567adfd6b9235ed112679159054cbce7e41fe6d31935bc33d5809510b2c5bbb7b0
SHA512e869104c4fb3bbd5528fce4b58ac1d35ccefca2950a2f8e2d2ccbab4d8fdc5103bad1db06c0f6e17922677b7680cdfe1b216c56f9d0074843f38d532f2520941
-
Filesize
351KB
MD50af623263a246bfb9b4fbeb46ae6f988
SHA1349bab704498a9a356f4f16b345ac86f9bde8be7
SHA256fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd
SHA5128a912f624a690760c993f16632d61caf43c78dfc5ac913725c0ca7ef53ddf5489b9358647e44483a20d75ebbf9a3b99a49acf2ecc4f9cf1f7c49b1ab26644db4
-
Filesize
351KB
MD50af623263a246bfb9b4fbeb46ae6f988
SHA1349bab704498a9a356f4f16b345ac86f9bde8be7
SHA256fd620c564175b871dd21cb94e4640fece901783352198494e8e0a09f2da2a6cd
SHA5128a912f624a690760c993f16632d61caf43c78dfc5ac913725c0ca7ef53ddf5489b9358647e44483a20d75ebbf9a3b99a49acf2ecc4f9cf1f7c49b1ab26644db4
-
Filesize
614.3MB
MD54e5735b45014aebc3f530f0df2bbda37
SHA11d90d8250be69d216a15c9091d2920b43931aaf2
SHA256636dff63a872e8c45bf9aa9c5b819dff650309d490715a4381e6e846982e754f
SHA5126f18df5a2bdb7988c12b6a09796274d93c35b4358c1900a8dfc35d38e0787666bae759260a71e9b6bc5fe56273f944dd48e35f1c0240ac7c12b82bc01a6a8151
-
Filesize
612.8MB
MD5bfcdb90d21d5a6b81906a1721ba24b64
SHA19bbcff141fac59b0f078100d02eb46650e878c26
SHA2564d89017478ad1c26fffcae6f1df8deac9e7f34a66d00c2094a4748dfc640e988
SHA51232830dc49dd91cfcf3de54e1e8dac63696cc6b760b9c2a3e22f709164a2cd4b10747dd511643d5aee24a64574a1989161508f500930d16dfa56436c2fcdcd179