Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
051b8fe31a4832078eb31d3b45228ddd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
051b8fe31a4832078eb31d3b45228ddd.exe
Resource
win10v2004-20231215-en
General
-
Target
051b8fe31a4832078eb31d3b45228ddd.exe
-
Size
178KB
-
MD5
051b8fe31a4832078eb31d3b45228ddd
-
SHA1
d3e4eee251493d835ce57d093c2542a902daea04
-
SHA256
70b6e46b2d70a18bec9d70a986602c0d67fc0c4400290559e733c2f1c87fa64b
-
SHA512
950c112584f24c3c28938d54a2436dfb86aea352b7f075190f99e70482dd8bcf3017e6ecdf3453dc1fcff90f3e2bffdea14e01d9af2274530633530ab3b46672
-
SSDEEP
3072:5WdXlH1d/+brNwMKIGS1pQLLqzcyxzaRTVetumCvIWArywoOLi6:5AVduNDKIGuqLL4cy10VQSRwoOL
Malware Config
Extracted
smokeloader
0408
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1252 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2156 set thread context of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 051b8fe31a4832078eb31d3b45228ddd.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 051b8fe31a4832078eb31d3b45228ddd.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 051b8fe31a4832078eb31d3b45228ddd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2328 051b8fe31a4832078eb31d3b45228ddd.exe 2328 051b8fe31a4832078eb31d3b45228ddd.exe 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found 1252 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2328 051b8fe31a4832078eb31d3b45228ddd.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28 PID 2156 wrote to memory of 2328 2156 051b8fe31a4832078eb31d3b45228ddd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"C:\Users\Admin\AppData\Local\Temp\051b8fe31a4832078eb31d3b45228ddd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2328
-