Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 17:35
Static task
static1
Behavioral task
behavioral1
Sample
50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe
-
Size
216KB
-
MD5
d2485d51e907b5eccdc8d8fe7d97aa3e
-
SHA1
5319c6456f036468394873298c2b594049bd0542
-
SHA256
50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a
-
SHA512
e666b2e2f7d0b4865d5109dc6b3a6014f5d6a7e566e877f7b81d31f6954b57d9bdda962240ed888c33a5ce8ccdb0142d99bc92ab09525fdde17cb417ee848633
-
SSDEEP
3072:dHXMBlai8Kr4SB5UMrafG8o0JS143oAIaKIertYwC5UgT7:BMBlrr4SjRwZy43ocugT
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://gudintas.at/tmp/
http://pik96.ru/tmp/
http://rosatiauto.com/tmp/
http://kingpirate.ru/tmp/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 540 50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe 540 50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found 2632 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 540 50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found Token: SeShutdownPrivilege 2632 Process not Found Token: SeCreatePagefilePrivilege 2632 Process not Found -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2632 Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe"C:\Users\Admin\AppData\Local\Temp\50ca44cd9e6ad637a5d72c02971497d62f3ac9b6b50acf8c66a3fe2f75e1ec9a_JC.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:540