Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
369s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe
Resource
win10v2004-20231215-en
General
-
Target
ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe
-
Size
344KB
-
MD5
766801c28e2bba5d4587ee22941b6528
-
SHA1
b718a320f4482e397719552f098a67b883c88b28
-
SHA256
4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f
-
SHA512
8f5cb9f7f71add967a44376f7d013b9342c9fc2d64413e32782354d3fa7959c55a07367bf41e1452296fe9b3b8add120449889195a5954044ccb8279df81eced
-
SSDEEP
6144:Rg0i18FzH1EdOesCdFGSRacbvJNLW9Y3fXkAF:Op18FzH+dOevRaclNDfUAF
Malware Config
Extracted
smokeloader
2022
http://kitfishstore.ru/index.php
http://homemademagazine.ru/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1188 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 568 ahfscws -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ahfscws Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ahfscws Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ahfscws Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1180 ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe 1180 ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found 1188 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1188 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1180 ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe 568 ahfscws -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1188 Process not Found Token: SeShutdownPrivilege 1188 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1188 Process not Found 1188 Process not Found -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1188 Process not Found 1188 Process not Found 1188 Process not Found -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1048 wrote to memory of 568 1048 taskeng.exe 31 PID 1048 wrote to memory of 568 1048 taskeng.exe 31 PID 1048 wrote to memory of 568 1048 taskeng.exe 31 PID 1048 wrote to memory of 568 1048 taskeng.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe"C:\Users\Admin\AppData\Local\Temp\ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1180
-
C:\Windows\system32\taskeng.exetaskeng.exe {B230B369-0C9C-46AE-B956-DFE794293ABB} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Roaming\ahfscwsC:\Users\Admin\AppData\Roaming\ahfscws2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:568
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD5766801c28e2bba5d4587ee22941b6528
SHA1b718a320f4482e397719552f098a67b883c88b28
SHA2564841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f
SHA5128f5cb9f7f71add967a44376f7d013b9342c9fc2d64413e32782354d3fa7959c55a07367bf41e1452296fe9b3b8add120449889195a5954044ccb8279df81eced