Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe
Resource
win10v2004-20230220-en
General
-
Target
c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe
-
Size
291KB
-
MD5
67e7ed22a07e6220b155e157d7429df0
-
SHA1
c7cd04aa0c5164a0c4611bdb7818e032e567cc0b
-
SHA256
c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437
-
SHA512
8b6c0f6eaca57cf1ef6252d964fe86086aa3cb385e9fb57bef5708ba0d4f00588adebdea932bde04159e4ac3f26ae7a24f3afe35cfef2ed3c0677c034b958bb3
-
SSDEEP
3072:4ETdCVIpw0puSkAXFtB/goZF+QnOewoIUhpGnhw+1E1XtsGcJBQjC2K:bkh0JXFAknOeZpcwhXWGxjC2K
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
pid Process 5048 juchjji -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI juchjji Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI juchjji Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI juchjji -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe 2000 c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3156 Process not Found -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 2000 c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 3156 Process not Found 5048 juchjji -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3156 wrote to memory of 2216 3156 Process not Found 86 PID 3156 wrote to memory of 2216 3156 Process not Found 86 PID 3156 wrote to memory of 2216 3156 Process not Found 86 PID 3156 wrote to memory of 2216 3156 Process not Found 86 PID 3156 wrote to memory of 2716 3156 Process not Found 87 PID 3156 wrote to memory of 2716 3156 Process not Found 87 PID 3156 wrote to memory of 2716 3156 Process not Found 87 PID 3156 wrote to memory of 4576 3156 Process not Found 88 PID 3156 wrote to memory of 4576 3156 Process not Found 88 PID 3156 wrote to memory of 4576 3156 Process not Found 88 PID 3156 wrote to memory of 4576 3156 Process not Found 88 PID 3156 wrote to memory of 4136 3156 Process not Found 90 PID 3156 wrote to memory of 4136 3156 Process not Found 90 PID 3156 wrote to memory of 4136 3156 Process not Found 90 PID 3156 wrote to memory of 2156 3156 Process not Found 91 PID 3156 wrote to memory of 2156 3156 Process not Found 91 PID 3156 wrote to memory of 2156 3156 Process not Found 91 PID 3156 wrote to memory of 2156 3156 Process not Found 91 PID 3156 wrote to memory of 4316 3156 Process not Found 92 PID 3156 wrote to memory of 4316 3156 Process not Found 92 PID 3156 wrote to memory of 4316 3156 Process not Found 92 PID 3156 wrote to memory of 4316 3156 Process not Found 92 PID 3156 wrote to memory of 3724 3156 Process not Found 93 PID 3156 wrote to memory of 3724 3156 Process not Found 93 PID 3156 wrote to memory of 3724 3156 Process not Found 93 PID 3156 wrote to memory of 3724 3156 Process not Found 93 PID 3156 wrote to memory of 5092 3156 Process not Found 94 PID 3156 wrote to memory of 5092 3156 Process not Found 94 PID 3156 wrote to memory of 5092 3156 Process not Found 94 PID 3156 wrote to memory of 2420 3156 Process not Found 95 PID 3156 wrote to memory of 2420 3156 Process not Found 95 PID 3156 wrote to memory of 2420 3156 Process not Found 95 PID 3156 wrote to memory of 2420 3156 Process not Found 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe"C:\Users\Admin\AppData\Local\Temp\c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2000
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2216
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2716
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4576
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4136
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2156
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4316
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3724
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5092
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2420
-
C:\Users\Admin\AppData\Roaming\juchjjiC:\Users\Admin\AppData\Roaming\juchjji1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
291KB
MD567e7ed22a07e6220b155e157d7429df0
SHA1c7cd04aa0c5164a0c4611bdb7818e032e567cc0b
SHA256c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437
SHA5128b6c0f6eaca57cf1ef6252d964fe86086aa3cb385e9fb57bef5708ba0d4f00588adebdea932bde04159e4ac3f26ae7a24f3afe35cfef2ed3c0677c034b958bb3
-
Filesize
291KB
MD567e7ed22a07e6220b155e157d7429df0
SHA1c7cd04aa0c5164a0c4611bdb7818e032e567cc0b
SHA256c6c8546328d6d91d3a1495875bf954e731533216df59e46bc393ce289d37e437
SHA5128b6c0f6eaca57cf1ef6252d964fe86086aa3cb385e9fb57bef5708ba0d4f00588adebdea932bde04159e4ac3f26ae7a24f3afe35cfef2ed3c0677c034b958bb3