Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
168s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 08:02
General
-
Target
12e54eb47a6f1fd3a3a7122928b9ef78.exe
-
Size
223KB
-
MD5
12e54eb47a6f1fd3a3a7122928b9ef78
-
SHA1
162bb7541d25c7c80cba52a1dbcf88e12f914013
-
SHA256
065b657a5177115ebbce711679d1b5b4161cef9f2a532d770afb06d6ed4abd84
-
SHA512
cf7187f19a6211151c1967df1f3103b53217cac88fe4ec3a9f49647a24d31c7789edf52c2d4851a26040404f714bab36fdc845f136512155ceef57104dbc3480
-
SSDEEP
3072:mAfQT4fqnI9aApOQCJU1VNCuICdjk45+w7YWnWnCNeoBeTo/Y3b:xqnI9awOXJ6mU5kvbWWCIwR
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\12e54eb47a6f1fd3a3a7122928b9ef78.exe"C:\Users\Admin\AppData\Local\Temp\12e54eb47a6f1fd3a3a7122928b9ef78.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
40.4MB
-
Filesize
40.4MB
-
Filesize
36KB