Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 01:28

General

  • Target

    dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe

  • Size

    312KB

  • MD5

    3ed9f2c6339d6513940c15d4a58378af

  • SHA1

    bd75e9514537bb38e9ba648c92a837e7d8d7b66d

  • SHA256

    dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb

  • SHA512

    530d1c04fd3acc0a35b54221ae5e25b4ab02fdf656bfda516bab009e94f292cffec83a8480cf95c3bacddc295a845206e6409658c837c3c78f0d1aca5cdf8036

  • SSDEEP

    6144:V6xELH+Ym/eqLhvhXfRWK4Pg343g77ji:cxEL+HeqLh2K45QX

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 8 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Disables taskbar notifications via registry modification
  • Disables use of System Restore points 1 TTPs
  • Sets file execution options in registry 2 TTPs 20 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • NTFS ADS 2 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1224
    • C:\Users\Admin\AppData\Local\Temp\dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe
      "C:\Users\Admin\AppData\Local\Temp\dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2672
    • C:\Users\Admin\AppData\Local\Temp\9434.exe
      C:\Users\Admin\AppData\Local\Temp\9434.exe
      2⤵
      • Sets file execution options in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2656
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Sets file execution options in registry
        • Checks BIOS information in registry
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • NTFS ADS
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2928
        • C:\Users\Admin\AppData\Local\Temp\95mcacs5e_1.exe
          /suac
          4⤵
          • Modifies firewall policy service
          • Sets file execution options in registry
          • Executes dropped EXE
          • Checks for any installed AV software in registry
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Windows\SysWOW64\regedit.exe
            "C:\Windows\SysWOW64\regedit.exe"
            5⤵
            • Modifies security service
            • Sets file execution options in registry
            • Sets service image path in registry
            • Runs regedit.exe
            • Suspicious use of AdjustPrivilegeToken
            PID:552
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\95MCAC~1.EXE" /RL HIGHEST
            5⤵
            • Creates scheduled task(s)
            PID:2812
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1164
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
      1⤵
        PID:1592
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "-100682134221394251901835388546-65081776813613227561093905680233684672-1879801528"
        1⤵
          PID:1700

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\9434.exe

          Filesize

          360KB

          MD5

          80c413180b6bd0dd664adc4e0665b494

          SHA1

          e791e4a3391fc6b7bcb58399cd4fa3c52a06b940

          SHA256

          6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880

          SHA512

          347f4ae6f308b37d055a6177478e45ab3838d7020abed70c7aa138d2c3771e709de204da8550aebdcaa6139d869dc7328cc7e645c4dd48d1066f9ad70225644a

        • C:\Users\Admin\AppData\Roaming\ibcusrh

          Filesize

          312KB

          MD5

          3ed9f2c6339d6513940c15d4a58378af

          SHA1

          bd75e9514537bb38e9ba648c92a837e7d8d7b66d

          SHA256

          dd02b4f83462302b06278dea2591a9d32ab4534743f96b44b24d642e55b721fb

          SHA512

          530d1c04fd3acc0a35b54221ae5e25b4ab02fdf656bfda516bab009e94f292cffec83a8480cf95c3bacddc295a845206e6409658c837c3c78f0d1aca5cdf8036

        • memory/552-103-0x00000000000D0000-0x00000000000DB000-memory.dmp

          Filesize

          44KB

        • memory/552-98-0x00000000000D0000-0x00000000000DB000-memory.dmp

          Filesize

          44KB

        • memory/552-97-0x0000000000D50000-0x0000000000DB5000-memory.dmp

          Filesize

          404KB

        • memory/552-95-0x0000000000D50000-0x0000000000DB6000-memory.dmp

          Filesize

          408KB

        • memory/552-94-0x0000000000D50000-0x0000000000DB6000-memory.dmp

          Filesize

          408KB

        • memory/1224-57-0x00000000029D0000-0x00000000029D6000-memory.dmp

          Filesize

          24KB

        • memory/1224-89-0x0000000002980000-0x0000000002981000-memory.dmp

          Filesize

          4KB

        • memory/1224-56-0x00000000774F1000-0x00000000774F2000-memory.dmp

          Filesize

          4KB

        • memory/1224-5-0x00000000029A0000-0x00000000029B6000-memory.dmp

          Filesize

          88KB

        • memory/1592-87-0x00000000774F1000-0x00000000774F2000-memory.dmp

          Filesize

          4KB

        • memory/1700-104-0x00000000774F1000-0x00000000774F2000-memory.dmp

          Filesize

          4KB

        • memory/2656-24-0x0000000077690000-0x0000000077691000-memory.dmp

          Filesize

          4KB

        • memory/2656-44-0x00000000004A0000-0x0000000000506000-memory.dmp

          Filesize

          408KB

        • memory/2656-19-0x0000000000010000-0x000000000006D000-memory.dmp

          Filesize

          372KB

        • memory/2656-20-0x00000000004A0000-0x0000000000506000-memory.dmp

          Filesize

          408KB

        • memory/2656-21-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2656-22-0x0000000000230000-0x000000000023D000-memory.dmp

          Filesize

          52KB

        • memory/2656-26-0x0000000001D00000-0x0000000001D01000-memory.dmp

          Filesize

          4KB

        • memory/2656-28-0x00000000004A0000-0x0000000000506000-memory.dmp

          Filesize

          408KB

        • memory/2656-27-0x0000000001D70000-0x0000000001D7C000-memory.dmp

          Filesize

          48KB

        • memory/2656-23-0x00000000004A0000-0x0000000000506000-memory.dmp

          Filesize

          408KB

        • memory/2672-6-0x0000000000400000-0x000000000086F000-memory.dmp

          Filesize

          4.4MB

        • memory/2672-3-0x0000000000400000-0x000000000086F000-memory.dmp

          Filesize

          4.4MB

        • memory/2672-2-0x0000000000220000-0x0000000000229000-memory.dmp

          Filesize

          36KB

        • memory/2672-1-0x0000000000930000-0x0000000000A30000-memory.dmp

          Filesize

          1024KB

        • memory/2812-99-0x0000000002140000-0x0000000002204000-memory.dmp

          Filesize

          784KB

        • memory/2928-51-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-66-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-47-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-48-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-49-0x0000000000430000-0x0000000000436000-memory.dmp

          Filesize

          24KB

        • memory/2928-50-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-37-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-52-0x00000000001D0000-0x0000000000294000-memory.dmp

          Filesize

          784KB

        • memory/2928-53-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-54-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-55-0x00000000001D0000-0x0000000000294000-memory.dmp

          Filesize

          784KB

        • memory/2928-45-0x0000000000A90000-0x0000000000A91000-memory.dmp

          Filesize

          4KB

        • memory/2928-40-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-58-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-59-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-60-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-61-0x00000000029D0000-0x00000000029D6000-memory.dmp

          Filesize

          24KB

        • memory/2928-62-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-63-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-64-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-65-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-46-0x00000000001D0000-0x0000000000294000-memory.dmp

          Filesize

          784KB

        • memory/2928-75-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-30-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-31-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-33-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-32-0x00000000001D0000-0x0000000000294000-memory.dmp

          Filesize

          784KB

        • memory/2928-35-0x0000000000430000-0x0000000000436000-memory.dmp

          Filesize

          24KB

        • memory/2928-34-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-85-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-41-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

          Filesize

          48KB

        • memory/2928-43-0x00000000001D0000-0x0000000000294000-memory.dmp

          Filesize

          784KB

        • memory/2928-36-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-93-0x0000000077680000-0x0000000077801000-memory.dmp

          Filesize

          1.5MB

        • memory/2928-38-0x00000000001D0000-0x0000000000294000-memory.dmp

          Filesize

          784KB

        • memory/2996-88-0x0000000000010000-0x000000000006D000-memory.dmp

          Filesize

          372KB

        • memory/2996-83-0x00000000003B0000-0x00000000003B6000-memory.dmp

          Filesize

          24KB

        • memory/2996-84-0x0000000001CF0000-0x0000000001D56000-memory.dmp

          Filesize

          408KB

        • memory/2996-82-0x0000000001CF0000-0x0000000001D56000-memory.dmp

          Filesize

          408KB

        • memory/2996-78-0x0000000001CF0000-0x0000000001D56000-memory.dmp

          Filesize

          408KB

        • memory/2996-81-0x0000000002510000-0x000000000251C000-memory.dmp

          Filesize

          48KB

        • memory/2996-79-0x0000000001CF0000-0x0000000001D56000-memory.dmp

          Filesize

          408KB