Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2023, 17:23
Static task
static1
Behavioral task
behavioral1
Sample
206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe
Resource
win10v2004-20230221-en
General
-
Target
206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe
-
Size
216KB
-
MD5
a9c013daef4b72f9cd4be407a3bbdf14
-
SHA1
ff24239f31994e6b292604703113dd79dd1561f0
-
SHA256
206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe
-
SHA512
c2afa59e6ec9b65d7ba850753a72f376d219d7cf31566545e8e123b73e0719004cf6ba17671427a6b035f2d4cd44b94827698e535d40aae9aa2128019a5c2f72
-
SSDEEP
3072:TEBYusOtAJMIpLhHApBJHJhe8DFo5qWj50:QHsOtAJNdHiBJHzBF3Wj
Malware Config
Extracted
smokeloader
pu10
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1484 set thread context of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5116 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 5116 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3156 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5116 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1484 wrote to memory of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 PID 1484 wrote to memory of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 PID 1484 wrote to memory of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 PID 1484 wrote to memory of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 PID 1484 wrote to memory of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 PID 1484 wrote to memory of 5116 1484 206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe"C:\Users\Admin\AppData\Local\Temp\206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe"C:\Users\Admin\AppData\Local\Temp\206ed1c73eaeb656b871a75016273e8f893b79ad3d9fa7102fe3de0e01aefefe.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5116
-