Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
bcdfff17f59ec08ae2e0d1c420a36441.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bcdfff17f59ec08ae2e0d1c420a36441.exe
Resource
win10v2004-20240226-en
General
-
Target
bcdfff17f59ec08ae2e0d1c420a36441.exe
-
Size
176KB
-
MD5
bcdfff17f59ec08ae2e0d1c420a36441
-
SHA1
bc8e5c179ee65cdc43e7d6465ba148f264cef98c
-
SHA256
ec5d0c18661d4915a4e24d844eb5c53e560640e348e96f7edb39fb165660a9bb
-
SHA512
c064980467ecb4f7a5c90bae981796ebec073f28a14669f2d3f7b87218d94dafcb2f6cf7a5266180e0e4dcc85edfca93b15402a25d3bea6f2ba68bfe01baaf4c
-
SSDEEP
3072:WUR8oLwlyMMa4NfBw3ZQ0z0KV5gXtjSwrv9ENPGiR6KJIX:nRrLwlp4ZBw3iBtVvMGikK
Malware Config
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3360 Process not Found -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcdfff17f59ec08ae2e0d1c420a36441.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcdfff17f59ec08ae2e0d1c420a36441.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcdfff17f59ec08ae2e0d1c420a36441.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 bcdfff17f59ec08ae2e0d1c420a36441.exe 2444 bcdfff17f59ec08ae2e0d1c420a36441.exe 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found 3360 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2444 bcdfff17f59ec08ae2e0d1c420a36441.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3360 Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.