Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 21:01
Static task
static1
Behavioral task
behavioral1
Sample
00174a8ed6db23527b71e10b20f95f1a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
00174a8ed6db23527b71e10b20f95f1a.exe
Resource
win10-20231215-en
Behavioral task
behavioral3
Sample
00174a8ed6db23527b71e10b20f95f1a.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
00174a8ed6db23527b71e10b20f95f1a.exe
Resource
win11-20231215-en
General
-
Target
00174a8ed6db23527b71e10b20f95f1a.exe
-
Size
206KB
-
MD5
00174a8ed6db23527b71e10b20f95f1a
-
SHA1
b18034926c23b5fe6738bb96ce7e0171d4e9afad
-
SHA256
87582213c6a87191e11d621987a201e02150f2be27673b6368b353e4707ff966
-
SHA512
a6a8eab01ba65bc8f5491c30b690ba4c5b3e2f27d1b5680523a18c5c6dbbe53220ae77beca716fa86083bbd003ab3ab47b62f603d1fc86516681e42e350a7174
-
SSDEEP
3072:tQ5pt5qw+Tq2Jc/4LoyZ2QA5wbuRWppK1dFnArywoOLi6R:tIZqNTA/4U6btppAnRwoOL
Malware Config
Extracted
smokeloader
pub5
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1236 Process not Found -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 00174a8ed6db23527b71e10b20f95f1a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 00174a8ed6db23527b71e10b20f95f1a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 00174a8ed6db23527b71e10b20f95f1a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 840 00174a8ed6db23527b71e10b20f95f1a.exe 840 00174a8ed6db23527b71e10b20f95f1a.exe 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found 1236 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 840 00174a8ed6db23527b71e10b20f95f1a.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.