Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/01/2024, 07:31

240126-jcpx7aghd3 10

26/01/2024, 07:25

240126-h81h5aggd5 10

Analysis

  • max time kernel
    600s
  • max time network
    369s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 07:31

General

  • Target

    ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe

  • Size

    344KB

  • MD5

    766801c28e2bba5d4587ee22941b6528

  • SHA1

    b718a320f4482e397719552f098a67b883c88b28

  • SHA256

    4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f

  • SHA512

    8f5cb9f7f71add967a44376f7d013b9342c9fc2d64413e32782354d3fa7959c55a07367bf41e1452296fe9b3b8add120449889195a5954044ccb8279df81eced

  • SSDEEP

    6144:Rg0i18FzH1EdOesCdFGSRacbvJNLW9Y3fXkAF:Op18FzH+dOevRaclNDfUAF

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://kitfishstore.ru/index.php

http://homemademagazine.ru/index.php

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1180
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {B230B369-0C9C-46AE-B956-DFE794293ABB} S-1-5-21-3427588347-1492276948-3422228430-1000:QVMRJQQO\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Roaming\ahfscws
      C:\Users\Admin\AppData\Roaming\ahfscws
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\ahfscws

    Filesize

    344KB

    MD5

    766801c28e2bba5d4587ee22941b6528

    SHA1

    b718a320f4482e397719552f098a67b883c88b28

    SHA256

    4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f

    SHA512

    8f5cb9f7f71add967a44376f7d013b9342c9fc2d64413e32782354d3fa7959c55a07367bf41e1452296fe9b3b8add120449889195a5954044ccb8279df81eced

  • memory/568-15-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/568-14-0x00000000005A0000-0x00000000006A0000-memory.dmp

    Filesize

    1024KB

  • memory/568-17-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/1180-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

    Filesize

    1024KB

  • memory/1180-2-0x0000000000220000-0x000000000022B000-memory.dmp

    Filesize

    44KB

  • memory/1180-3-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/1180-5-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/1188-4-0x0000000002C90000-0x0000000002CA6000-memory.dmp

    Filesize

    88KB

  • memory/1188-16-0x0000000002B60000-0x0000000002B76000-memory.dmp

    Filesize

    88KB