Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2023, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe
Resource
win10v2004-20230220-en
General
-
Target
49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe
-
Size
322KB
-
MD5
f9b1d55654308e893e49ec62c9ea5aa7
-
SHA1
dd8604a3ff8e6a7fb284cbb703143311b5072dd8
-
SHA256
49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
-
SHA512
000bc79f49c6bea78d807a3adcb3da0366f1ae35c4e5929046e2b05f176d6eda70f7b88a23d51d0b7781b7d406d8eb9bb35c20ffb6d3b539046bb3fb12bda245
-
SSDEEP
3072:SPapJc+lYWQGGiZaSptQ5Xem0qGsF0doQZC66YrrMWUfN0c9tVtbCaS0GRPma:Si7OQvpS5XeNBLZC66SYRB99i
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
pid Process 2740 rceefar -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rceefar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rceefar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rceefar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4348 49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe 4348 49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3180 Process not Found -
Suspicious behavior: MapViewOfSection 20 IoCs
pid Process 4348 49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 3180 Process not Found 2740 rceefar -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3180 wrote to memory of 5020 3180 Process not Found 88 PID 3180 wrote to memory of 5020 3180 Process not Found 88 PID 3180 wrote to memory of 5020 3180 Process not Found 88 PID 3180 wrote to memory of 5020 3180 Process not Found 88 PID 3180 wrote to memory of 5028 3180 Process not Found 89 PID 3180 wrote to memory of 5028 3180 Process not Found 89 PID 3180 wrote to memory of 5028 3180 Process not Found 89 PID 3180 wrote to memory of 2896 3180 Process not Found 91 PID 3180 wrote to memory of 2896 3180 Process not Found 91 PID 3180 wrote to memory of 2896 3180 Process not Found 91 PID 3180 wrote to memory of 2896 3180 Process not Found 91 PID 3180 wrote to memory of 3644 3180 Process not Found 92 PID 3180 wrote to memory of 3644 3180 Process not Found 92 PID 3180 wrote to memory of 3644 3180 Process not Found 92 PID 3180 wrote to memory of 4432 3180 Process not Found 93 PID 3180 wrote to memory of 4432 3180 Process not Found 93 PID 3180 wrote to memory of 4432 3180 Process not Found 93 PID 3180 wrote to memory of 4432 3180 Process not Found 93 PID 3180 wrote to memory of 1876 3180 Process not Found 94 PID 3180 wrote to memory of 1876 3180 Process not Found 94 PID 3180 wrote to memory of 1876 3180 Process not Found 94 PID 3180 wrote to memory of 1876 3180 Process not Found 94 PID 3180 wrote to memory of 1424 3180 Process not Found 95 PID 3180 wrote to memory of 1424 3180 Process not Found 95 PID 3180 wrote to memory of 1424 3180 Process not Found 95 PID 3180 wrote to memory of 1424 3180 Process not Found 95 PID 3180 wrote to memory of 972 3180 Process not Found 96 PID 3180 wrote to memory of 972 3180 Process not Found 96 PID 3180 wrote to memory of 972 3180 Process not Found 96 PID 3180 wrote to memory of 3488 3180 Process not Found 97 PID 3180 wrote to memory of 3488 3180 Process not Found 97 PID 3180 wrote to memory of 3488 3180 Process not Found 97 PID 3180 wrote to memory of 3488 3180 Process not Found 97 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe"C:\Users\Admin\AppData\Local\Temp\49fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4348
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5020
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5028
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2896
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3644
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4432
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1876
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1424
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:972
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3488
-
C:\Users\Admin\AppData\Roaming\rceefarC:\Users\Admin\AppData\Roaming\rceefar1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2740
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
322KB
MD5f9b1d55654308e893e49ec62c9ea5aa7
SHA1dd8604a3ff8e6a7fb284cbb703143311b5072dd8
SHA25649fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
SHA512000bc79f49c6bea78d807a3adcb3da0366f1ae35c4e5929046e2b05f176d6eda70f7b88a23d51d0b7781b7d406d8eb9bb35c20ffb6d3b539046bb3fb12bda245
-
Filesize
322KB
MD5f9b1d55654308e893e49ec62c9ea5aa7
SHA1dd8604a3ff8e6a7fb284cbb703143311b5072dd8
SHA25649fd772c6007383b249067c367f1250415c5e66f76002163ecba38fb4bc6c6f9
SHA512000bc79f49c6bea78d807a3adcb3da0366f1ae35c4e5929046e2b05f176d6eda70f7b88a23d51d0b7781b7d406d8eb9bb35c20ffb6d3b539046bb3fb12bda245