Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 03:03
General
-
Target
ed4688e4ffa0fd18e4944e807233aaa2c6a222190bb4fb922e2d34d615743049.exe
-
Size
240KB
-
MD5
d0a7a3d6e6ea45400a4abe921da559f0
-
SHA1
83b8de1e13d3ca29b76418fdc71d1c061915f204
-
SHA256
ed4688e4ffa0fd18e4944e807233aaa2c6a222190bb4fb922e2d34d615743049
-
SHA512
416a46bf0a385a477b87abf26f86863f9723a7d3bba26d750c9cb217c47d880c14d8396364b1bf66c8937285a31672196ddda6f00328b8cd2a5fe94f4f3f79b1
-
SSDEEP
6144:YC5frpxdonyq4zaG2u5AOreKRbvbIdLOIquqp:YErp0/9u5teqkpBquqp
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed4688e4ffa0fd18e4944e807233aaa2c6a222190bb4fb922e2d34d615743049.exe"C:\Users\Admin\AppData\Local\Temp\ed4688e4ffa0fd18e4944e807233aaa2c6a222190bb4fb922e2d34d615743049.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 2722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4432 -ip 44321⤵
-
C:\Users\Admin\AppData\Local\Temp\842A.exeC:\Users\Admin\AppData\Local\Temp\842A.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD55b78d6e2cf4b9ae97b76d0716d59ef71
SHA1ca63cc48f4e60fdca0930bd21bf0a1a9f8e91573
SHA256d989fd8dd846c86ab504e6b6ed21a54b277a71bd81574029be241f0bd52288e4
SHA5123a518367854357f295c6a7637e8b778d778c8ad90730562deec94fd5cfe07381533586552d779fd7634a523c5f83a21e6624f6545366a6647a16d1999aef06af
-
Filesize
1.2MB
MD55b78d6e2cf4b9ae97b76d0716d59ef71
SHA1ca63cc48f4e60fdca0930bd21bf0a1a9f8e91573
SHA256d989fd8dd846c86ab504e6b6ed21a54b277a71bd81574029be241f0bd52288e4
SHA5123a518367854357f295c6a7637e8b778d778c8ad90730562deec94fd5cfe07381533586552d779fd7634a523c5f83a21e6624f6545366a6647a16d1999aef06af
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB