Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
23/10/2023, 05:04
General
-
Target
a26fa22fb2e2c1f2ab1ca28b271ae6f960e69f46fa5926b3e327beb656f0b5cc.exe
-
Size
254KB
-
MD5
8a5df9188d55f2e4139033e94b3ffe72
-
SHA1
7a013a3c6f1bf12752b979694bd774499ae62116
-
SHA256
a26fa22fb2e2c1f2ab1ca28b271ae6f960e69f46fa5926b3e327beb656f0b5cc
-
SHA512
6ba19498e8d721ad476abbb8b80c0a6a2038db440a1e772ae879da0ae38e11b636396e1f5ee3776267f2f02f3219c57d970258f70959a40c5d73dcc631cb4447
-
SSDEEP
3072:kwXA+hpKbLK0OSZvM5nF7crPiZ38PteyzjR5RZCo+Dn1K5x7625Uc4+wQAJQAfrz:R9hpKbL/LZ0M8M1pDf+SxafL/
Malware Config
Extracted
smokeloader
0024
Extracted
smokeloader
2022
https://utah-saints.com/search.php
https://atlanta-newspaper.com/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26fa22fb2e2c1f2ab1ca28b271ae6f960e69f46fa5926b3e327beb656f0b5cc.exe"C:\Users\Admin\AppData\Local\Temp\a26fa22fb2e2c1f2ab1ca28b271ae6f960e69f46fa5926b3e327beb656f0b5cc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
976KB
-
Filesize
36KB
-
Filesize
976KB
-
Filesize
88KB