Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20/12/2023, 04:02
General
-
Target
faa669660a14d7ab3fb483443b4ab86c.exe
-
Size
261KB
-
MD5
faa669660a14d7ab3fb483443b4ab86c
-
SHA1
cb5228829a559affd3a5d1bed3adf05df513e741
-
SHA256
359ddf4b6d3df8be2fd5a9ed0ade5211ae219ef29085f1a8737b39a75a3ca947
-
SHA512
093148dfa4015489713f88e51dd1a6d0012f8bb78c0e4f89afa95d205d60509f40b62046927973c5208e442c8dc6b161d743bdf91a6c1883978d08475c201fce
-
SSDEEP
3072:H4Iaat/GHT5oIAc3cvaBIPbjK4NuCID3Fh+BGDwkz0ZjtJaWw+YbCUBZGyLqdX:n+z5ONfZQFT+BGD1z0Z6h+JUBZLL
Malware Config
Extracted
smokeloader
pub4
Extracted
smokeloader
2022
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa669660a14d7ab3fb483443b4ab86c.exe"C:\Users\Admin\AppData\Local\Temp\faa669660a14d7ab3fb483443b4ab86c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4.9MB
-
Filesize
4.9MB