Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
11/01/2024, 02:28
General
-
Target
55cc830f41f9e74fbcfe2259d304c99b.exe
-
Size
312KB
-
MD5
55cc830f41f9e74fbcfe2259d304c99b
-
SHA1
f72fd071a6df30d6b0f145463ed4fe2f7d248e2b
-
SHA256
e6e106a5206be28f2b76c0190d3c1ba85d4f4bf759babd66c64d9a17a4219ddb
-
SHA512
293f62b48bda53c1d575636d30813cbb49865ee0d67302c001db3b1fec1de22a8fd2ae3945eca10903e15ee579e5ca22599fb8fb5a03594f593144c36c3aa131
-
SSDEEP
3072:rjEaOZ+J2LBo0V/NqF4wDa98Egq4IlmWUkbKUGn9zSw5n2iT9BARTYFkc:rSZ/LS0xNKr+9vdlm6bKUGnZnT3Fk
Malware Config
Extracted
smokeloader
2022
http://selebration17io.io/index.php
http://vacantion18ffeu.cc/index.php
http://valarioulinity1.net/index.php
http://buriatiarutuhuob.net/index.php
http://cassiosssionunu.me/index.php
http://sulugilioiu19.net/index.php
http://goodfooggooftool.net/index.php
http://legdfls2369.com/index.php
http://fpodsp0532xc.com/index.php
http://gucc352093520.com/index.php
Extracted
smokeloader
autm
Signatures
-
Detect Vidar Stealer 3 IoCs
-
Detect ZGRat V1 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
.NET Reactor proctector 6 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Program crash 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\55cc830f41f9e74fbcfe2259d304c99b.exe"C:\Users\Admin\AppData\Local\Temp\55cc830f41f9e74fbcfe2259d304c99b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\162E.exeC:\Users\Admin\AppData\Local\Temp\162E.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 10363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 6083⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\4B39.exeC:\Users\Admin\AppData\Local\Temp\4B39.exe1⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7140.exeC:\Users\Admin\AppData\Local\Temp\7140.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3640 -ip 36401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3640 -ip 36401⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD55665fcbdb71982c6d0ed4e7bcd3aead0
SHA1e76a1086bd7a614a0acbc78b5f0011c9c5ff9ac3
SHA256ef5c59ca42f0211f9b7460b38fa623914308fb9785af95fdafa367b1a258ecb3
SHA512f03224dc437868f204d5c2c7484fc509d1b39c151fb1e55233d7269afffcf9f1e4f3054818563be8b6f17447f307d038b231ee5995105880a248578f02b26a7d
-
Filesize
208KB
MD56d327e2052750b8a1f08919c27c319af
SHA10334cfdc92acf01b449d9a5c8b5f3ea112dd4d40
SHA2561ead06037c21d4434942c1b326f277f2e25fea4e9bc20248175d26c29e466888
SHA5129792b0467efcac932e5f69a3c3f292f4ce34c40cdec57a4b14b4945421d7881d7ac731b63863646b3957e3e6b476081df91ef7ff81ccaa000660b73e2a6cd99c
-
Filesize
117KB
MD582b5c2a949f6e23e219c90cb34629d92
SHA116d90bcb440947467c581b2b7b50fd0be0c9961c
SHA25606ffaf357616a55edfb19e5086de130f7df921e3bf6235aa24fd50a20e6bcd77
SHA512beffd2652ca3c8b18fe525b164e7472afdf996c7df39290f87f059aed9329c2f450281595ca50c00b5932cfd9d2fd1d4a1f0d992e856b97f67385fa0a6968849
-
Filesize
64KB
MD56230879d980abbee1f5e9ebb11d3c137
SHA1a3592f8929a54c5937076665b8f16517da36973c
SHA25685ee46e39411cbf90ea9bf421b02181cc5fdbb9b05b9240a595cf351f0040105
SHA51279e522a0f487229d66ca708c3e9f803e20c8c791d492681c7504cb2c5145d71d8c23b3b39a5ccb78fe06d252b58329db698dcda4fb5439c93aea2fed6097a619
-
Filesize
55KB
MD55aa36bf547279a1510e7a38fbaf12947
SHA1f59edbabbe02f6a4b4bc8e1dd3629fe66b153268
SHA256e7b49149f688e9e51c9f54fcc62e355fc006c86591f477a27c40ae71d37322c4
SHA51245e462f73247e6ab865bb979ec644dfd70011261b4a0a41e0ddb4e47b5d0a94bd5dcbef5a8f33ad9ec8227938705656865d476e0b86fa108967681f99634792c
-
Filesize
148KB
MD593bdf4b7a3299c815a9495e7f48b937d
SHA1e527126266a9baeb25db43ce4e3ad15856e887a6
SHA256a1f7ad060b973631fdf4dfd19bf8b7949ee4586d103fa61ab0724560db4a20a0
SHA51200cdd0e569ccdc11317f431f612e356bf8d618cba81aff7f23313cb77f280e11936cf859afdb73ad37fd8cc4c165b9132811d20f0f846366121173859c4cb7c6
-
Filesize
92KB
MD5e7e93c800f74b84706a6cf60844e8e03
SHA124fa13318c0393f37d632e41cf7eebf4ed1cf826
SHA25680e2132f3e5b995b1128cb69991f0f02f01fb5b9323cf9b275b3b71b98805b46
SHA512bbc9367dba2618c5ffb4f20a301d4637e9326d42786472eb034b71a12be83635c70f8d4779ff454aa5c91ae63fd191ef90f17d60bb98bba358530bc287faa6b6
-
Filesize
1KB
MD5f18b89b657eb57c4d584b80dae322eca
SHA1d4a6290f22c6439b3beabe99e31b9acfe4df9a6e
SHA25621db171f73a43bfec7253e56348e0591196de5276e9203f21d8cbcb39758ab29
SHA5125ef018041965e67dd6719ca358ed45f0fbafdee2e4e5535c2353f270e03753c64ed6765f57f1c4ecfbeac13acbdd87ee1687f8772d84ebdc95611232ad60168b
-
Filesize
17KB
MD5565c4597e8709a4f43ca04dbdfebaec1
SHA1a7520b89be6bd34b3d45f519015751caf7d54c22
SHA2566cb29eb5cfad358ce78ad9ad3255e5cd1bf940e4422d2cec267292bfed8e1408
SHA512b63700cb07fcf5d38cf902b23dd8d2446eef32c5c95873cd54e5c62a754f29dd353bfeb67dc87bd183703b8f2da8cf96099c1005be5831137c07bc9de05c4396
-
Filesize
28KB
MD55204745f9bbe97707ea688ea3f22834b
SHA19fe7c05b86b5d5b2f7667f4e51801d6b24b1fd26
SHA2567d973963c56b260a00e1fb0ac8995ab944192039da3eab8a75a92d1dff240cc6
SHA51255f3e16a2fe8bbadb6ca2c6457962c5926017c68f1d9820fe64cee78739acbff50c7bb4f08914efc7d391af3da6fb0bb16b24a2a6614119aed53b3fe07a6c3a6
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4.4MB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
1024KB
-
Filesize
3.7MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
200KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.9MB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
1.6MB
-
Filesize
2.1MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB