Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 21:16

General

  • Target

    2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c.exe

  • Size

    288KB

  • MD5

    870454d6dc60474e5c98db3a6551aa52

  • SHA1

    5f4cab81e841059908b4a252740dbfec429f1d8c

  • SHA256

    2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c

  • SHA512

    e3a6397090b3bb82de407b1b43d21c47161097bf4deee407e862f7baf65b319db83aabd5a92be12ffff373d907966f060b5ad2aad5a6c6d2b967e7fef23d0c83

  • SSDEEP

    3072:3aqUIlWrtEgY1HVxRwDRwXalOJTpr7f2rz7mImr4Z:Kq5W2l1HVxRwDqKI4/Bmr

Malware Config

Extracted

Family

smokeloader

Botnet

0024

Extracted

Family

smokeloader

Version

2022

C2

https://utah-saints.com/search.php

https://atlanta-newspaper.com/search.php

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c.exe
    "C:\Users\Admin\AppData\Local\Temp\2daaf257e213312ec2433b1a5f5ec1e0f47a88bc7a4f4f2ed86b06a84cd48a5c.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2952
  • C:\Windows\system32\cmd.exe
    cmd
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /format:csv
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1508
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path FirewallProduct Get displayName /format:csv
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3904
    • C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 Path AntiSpywareProduct Get displayName /format:csv
      2⤵
        PID:3120
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic /namespace:\\root\cimv2 Path Win32_Processor Get Name,DeviceID,NumberOfCores /format:csv
        2⤵
          PID:4448
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /namespace:\\root\cimv2 Path Win32_Product Get Name,Version /format:csv
          2⤵
            PID:384
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic /namespace:\\root\cimv2 Path Win32_NetworkAdapter Where PhysicalAdapter=TRUE Get Name,MACAddress,ProductName,ServiceName,NetConnectionID /format:csv
            2⤵
              PID:2000
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic /namespace:\\root\cimv2 Path Win32_StartupCommand Get Name,Location,Command /format:csv
              2⤵
                PID:4580
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic /namespace:\\root\cimv2 Path Win32_OperatingSystem Get Caption,CSDVersion,BuildNumber,Version,BuildType,CountryCode,CurrentTimeZone,InstallDate,LastBootUpTime,Locale,OSArchitecture,OSLanguage,OSProductSuite,OSType,SystemDirectory,Organization,RegisteredUser,SerialNumber /format:csv
                2⤵
                  PID:3740
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /namespace:\\root\cimv2 Path Win32_Process Get Caption,CommandLine,ExecutablePath,ProcessId /format:csv
                  2⤵
                    PID:3940
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic /namespace:\\root\cimv2 Path Win32_Volume Get Name,Label,FileSystem,SerialNumber,BootVolume,Capacity,DriveType /format:csv
                    2⤵
                      PID:1652
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic /namespace:\\root\cimv2 Path Win32_UserAccount Get Name,Domain,AccountType,LocalAccount,Disabled,Status,SID /format:csv
                      2⤵
                        PID:4912
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic /namespace:\\root\cimv2 Path Win32_GroupUser Get GroupComponent,PartComponent /format:csv
                        2⤵
                          PID:900
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic /namespace:\\root\cimv2 Path Win32_ComputerSystem Get Caption,Manufacturer,PrimaryOwnerName,UserName,Workgroup /format:csv
                          2⤵
                            PID:4856
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic /namespace:\\root\cimv2 Path Win32_PnPEntity Where ClassGuid="{50dd5230-ba8a-11d1-bf5d-0000f805f530}" Get Name,DeviceID,PNPDeviceID,Manufacturer,Description /format:csv
                            2⤵
                              PID:1328
                            • C:\Windows\system32\ipconfig.exe
                              ipconfig /displaydns
                              2⤵
                              • Gathers network information
                              PID:4432
                            • C:\Windows\system32\ROUTE.EXE
                              route print
                              2⤵
                                PID:1320
                              • C:\Windows\system32\netsh.exe
                                netsh firewall show state
                                2⤵
                                • Modifies Windows Firewall
                                PID:2856
                              • C:\Windows\system32\systeminfo.exe
                                systeminfo
                                2⤵
                                • Gathers system information
                                PID:2576
                              • C:\Windows\system32\tasklist.exe
                                tasklist /v
                                2⤵
                                • Enumerates processes with tasklist
                                PID:3008
                              • C:\Windows\system32\net.exe
                                net accounts /domain
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3252
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 accounts /domain
                                  3⤵
                                    PID:2252
                                • C:\Windows\system32\net.exe
                                  net share
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:856
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 share
                                    3⤵
                                      PID:3784
                                  • C:\Windows\system32\net.exe
                                    net user
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1716
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 user
                                      3⤵
                                        PID:4476
                                    • C:\Windows\system32\net.exe
                                      net user /domain
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3380
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 user /domain
                                        3⤵
                                          PID:2400
                                      • C:\Windows\system32\net.exe
                                        net use
                                        2⤵
                                          PID:5040
                                        • C:\Windows\system32\net.exe
                                          net group
                                          2⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:3040
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 group
                                            3⤵
                                              PID:2028
                                          • C:\Windows\system32\net.exe
                                            net localgroup
                                            2⤵
                                              PID:2504
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 localgroup
                                                3⤵
                                                  PID:1820
                                              • C:\Windows\system32\NETSTAT.EXE
                                                netstat -r
                                                2⤵
                                                • Gathers network information
                                                PID:1616
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
                                                  3⤵
                                                    PID:2136
                                                    • C:\Windows\system32\ROUTE.EXE
                                                      C:\Windows\system32\route.exe print
                                                      4⤵
                                                        PID:1628
                                                  • C:\Windows\system32\NETSTAT.EXE
                                                    netstat -nao
                                                    2⤵
                                                    • Gathers network information
                                                    PID:4128
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /query
                                                    2⤵
                                                      PID:3888
                                                    • C:\Windows\system32\ipconfig.exe
                                                      ipconfig /all
                                                      2⤵
                                                      • Gathers network information
                                                      PID:4208
                                                  • C:\Windows\system32\msiexec.exe
                                                    C:\Windows\system32\msiexec.exe /V
                                                    1⤵
                                                      PID:1144
                                                    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                                                      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                                                      1⤵
                                                        PID:2184
                                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                                        1⤵
                                                        • Modifies Internet Explorer settings
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:384
                                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:384 CREDAT:17410 /prefetch:2
                                                          2⤵
                                                          • Modifies Internet Explorer settings
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1804
                                                      • C:\Windows\SysWOW64\explorer.exe
                                                        C:\Windows\SysWOW64\explorer.exe
                                                        1⤵
                                                        • Accesses Microsoft Outlook profiles
                                                        • outlook_office_path
                                                        • outlook_win_path
                                                        PID:4504
                                                      • C:\Windows\explorer.exe
                                                        C:\Windows\explorer.exe
                                                        1⤵
                                                          PID:4332
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:4692
                                                        • C:\Windows\explorer.exe
                                                          C:\Windows\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:4380
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:1220
                                                        • C:\Windows\explorer.exe
                                                          C:\Windows\explorer.exe
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:3268
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          C:\Windows\SysWOW64\explorer.exe
                                                          1⤵
                                                            PID:1688
                                                          • C:\Windows\explorer.exe
                                                            C:\Windows\explorer.exe
                                                            1⤵
                                                              PID:3040

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              da597791be3b6e732f0bc8b20e38ee62

                                                              SHA1

                                                              1125c45d285c360542027d7554a5c442288974de

                                                              SHA256

                                                              5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

                                                              SHA512

                                                              d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H3JZN74\suggestions[1].en-US

                                                              Filesize

                                                              17KB

                                                              MD5

                                                              5a34cb996293fde2cb7a4ac89587393a

                                                              SHA1

                                                              3c96c993500690d1a77873cd62bc639b3a10653f

                                                              SHA256

                                                              c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

                                                              SHA512

                                                              e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

                                                            • memory/748-4-0x00000000025B0000-0x00000000025C6000-memory.dmp

                                                              Filesize

                                                              88KB

                                                            • memory/748-14-0x00000000026A0000-0x00000000026B0000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/1220-77-0x00000000005D0000-0x00000000005D5000-memory.dmp

                                                              Filesize

                                                              20KB

                                                            • memory/1220-78-0x00000000005C0000-0x00000000005C9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/1220-88-0x00000000005D0000-0x00000000005D5000-memory.dmp

                                                              Filesize

                                                              20KB

                                                            • memory/1220-89-0x00000000005C0000-0x00000000005C9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/1688-91-0x00000000005D0000-0x00000000005D6000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/1688-82-0x00000000005C0000-0x00000000005CB000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/1688-92-0x00000000005C0000-0x00000000005CB000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/1688-81-0x00000000005D0000-0x00000000005D6000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/2952-2-0x0000000000400000-0x0000000002285000-memory.dmp

                                                              Filesize

                                                              30.5MB

                                                            • memory/2952-5-0x0000000000400000-0x0000000002285000-memory.dmp

                                                              Filesize

                                                              30.5MB

                                                            • memory/2952-1-0x00000000022C0000-0x00000000023C0000-memory.dmp

                                                              Filesize

                                                              1024KB

                                                            • memory/2952-3-0x0000000003FD0000-0x0000000003FD9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/3040-84-0x00000000006A0000-0x00000000006AD000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/3040-85-0x00000000006B0000-0x00000000006B7000-memory.dmp

                                                              Filesize

                                                              28KB

                                                            • memory/3040-86-0x00000000006A0000-0x00000000006AD000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/3268-79-0x0000000000350000-0x000000000035C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/3268-90-0x0000000000350000-0x000000000035C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/3268-80-0x0000000000360000-0x0000000000366000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/4332-49-0x0000000000B10000-0x0000000000B17000-memory.dmp

                                                              Filesize

                                                              28KB

                                                            • memory/4332-50-0x0000000000B00000-0x0000000000B0C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/4332-48-0x0000000000B00000-0x0000000000B0C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/4380-87-0x0000000000570000-0x0000000000579000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/4380-76-0x0000000000560000-0x000000000056F000-memory.dmp

                                                              Filesize

                                                              60KB

                                                            • memory/4380-74-0x0000000000560000-0x000000000056F000-memory.dmp

                                                              Filesize

                                                              60KB

                                                            • memory/4380-75-0x0000000000570000-0x0000000000579000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/4504-25-0x0000000000800000-0x000000000086B000-memory.dmp

                                                              Filesize

                                                              428KB

                                                            • memory/4504-54-0x0000000000800000-0x000000000086B000-memory.dmp

                                                              Filesize

                                                              428KB

                                                            • memory/4504-26-0x0000000000800000-0x000000000086B000-memory.dmp

                                                              Filesize

                                                              428KB

                                                            • memory/4504-24-0x0000000000870000-0x00000000008E5000-memory.dmp

                                                              Filesize

                                                              468KB

                                                            • memory/4692-83-0x0000000000D90000-0x0000000000D9B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/4692-67-0x0000000000D90000-0x0000000000D9B000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/4692-68-0x0000000000DA0000-0x0000000000DA7000-memory.dmp

                                                              Filesize

                                                              28KB