Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2023, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
02523599.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
02523599.exe
Resource
win10v2004-20230220-en
General
-
Target
02523599.exe
-
Size
208KB
-
MD5
de8b620fd1e9886549da1ef48cfbfcb3
-
SHA1
52133262b5f5280a08e34f61823f3c2bbbc11df1
-
SHA256
c085ae21f3536226d317a92d7943c7a5c58d4d33b17941cb23131f01294c5fd6
-
SHA512
6fbd9975456ebfdb4e2e95348feff86554cebc22376a994d9af44c70079a628dbff8cda6a174e35ec92499ab1f20c403bf1e329e73e8b7ee06856ddaaa729770
-
SSDEEP
3072:wXj9yT+ZhkSxqTGiFfcCz6Te813lWRW02h1q5Z1HZEAb5juU+:kiqxWfV6gS1q5rOit
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5084 set thread context of 4448 5084 02523599.exe 82 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 02523599.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 02523599.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 02523599.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4448 02523599.exe 4448 02523599.exe 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found 2680 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4448 02523599.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5084 wrote to memory of 4448 5084 02523599.exe 82 PID 5084 wrote to memory of 4448 5084 02523599.exe 82 PID 5084 wrote to memory of 4448 5084 02523599.exe 82 PID 5084 wrote to memory of 4448 5084 02523599.exe 82 PID 5084 wrote to memory of 4448 5084 02523599.exe 82 PID 5084 wrote to memory of 4448 5084 02523599.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\02523599.exe"C:\Users\Admin\AppData\Local\Temp\02523599.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\02523599.exe"C:\Users\Admin\AppData\Local\Temp\02523599.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4448
-