Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 04:59
Static task
static1
Behavioral task
behavioral1
Sample
680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe
Resource
win10-20240214-en
General
-
Target
680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe
-
Size
282KB
-
MD5
80ac439ed5578df1e2cb3b92f6657389
-
SHA1
fabae3db5c332925dcc5f717ba15ffee7c5c7ed9
-
SHA256
680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c
-
SHA512
77121c3fa5ae6cb32a148bea8620902f3ff97fca8cb03c7b07bfc910671e7cd9b287787cbed464cbda9d04df6327aa566889470fe59576b580e5352035f00fc0
-
SSDEEP
3072:qP+7ppntxb2MJpSMI4cGHa0yFx2tK1W0zrDoehzBUu+lOafSBk8l5/:60tBDk4by/OK1Xzo2BUnTls5
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://nidoe.org/tmp/index.php
http://sodez.ru/tmp/index.php
http://uama.com.ua/tmp/index.php
http://talesofpirates.net/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1204 Process not Found -
Executes dropped EXE 1 IoCs
pid Process 2756 cuthwha -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cuthwha Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cuthwha Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cuthwha -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe 1712 680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found 1204 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1712 680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe 2756 cuthwha -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1204 Process not Found -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2756 2696 taskeng.exe 29 PID 2696 wrote to memory of 2756 2696 taskeng.exe 29 PID 2696 wrote to memory of 2756 2696 taskeng.exe 29 PID 2696 wrote to memory of 2756 2696 taskeng.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe"C:\Users\Admin\AppData\Local\Temp\680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1712
-
C:\Windows\system32\taskeng.exetaskeng.exe {392F633B-6D15-4CC6-9259-0534C2BA1647} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Roaming\cuthwhaC:\Users\Admin\AppData\Roaming\cuthwha2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
282KB
MD580ac439ed5578df1e2cb3b92f6657389
SHA1fabae3db5c332925dcc5f717ba15ffee7c5c7ed9
SHA256680fb6ca2c51e0cdb4ef67b5655616b3e8a4fab4bc01ab6c6a7a3420ecc97c1c
SHA51277121c3fa5ae6cb32a148bea8620902f3ff97fca8cb03c7b07bfc910671e7cd9b287787cbed464cbda9d04df6327aa566889470fe59576b580e5352035f00fc0