Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 08:02
Static task
static1
Behavioral task
behavioral1
Sample
12e54eb47a6f1fd3a3a7122928b9ef78.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
12e54eb47a6f1fd3a3a7122928b9ef78.exe
Resource
win10v2004-20231215-en
General
-
Target
12e54eb47a6f1fd3a3a7122928b9ef78.exe
-
Size
223KB
-
MD5
12e54eb47a6f1fd3a3a7122928b9ef78
-
SHA1
162bb7541d25c7c80cba52a1dbcf88e12f914013
-
SHA256
065b657a5177115ebbce711679d1b5b4161cef9f2a532d770afb06d6ed4abd84
-
SHA512
cf7187f19a6211151c1967df1f3103b53217cac88fe4ec3a9f49647a24d31c7789edf52c2d4851a26040404f714bab36fdc845f136512155ceef57104dbc3480
-
SSDEEP
3072:mAfQT4fqnI9aApOQCJU1VNCuICdjk45+w7YWnWnCNeoBeTo/Y3b:xqnI9awOXJ6mU5kvbWWCIwR
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1204 Process not Found -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 12e54eb47a6f1fd3a3a7122928b9ef78.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 12e54eb47a6f1fd3a3a7122928b9ef78.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 12e54eb47a6f1fd3a3a7122928b9ef78.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 12e54eb47a6f1fd3a3a7122928b9ef78.exe 2416 12e54eb47a6f1fd3a3a7122928b9ef78.exe 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2416 12e54eb47a6f1fd3a3a7122928b9ef78.exe