Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
59s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Resource
win10v2004-20240226-en
General
-
Target
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
-
Size
168KB
-
MD5
ec093454a010a3e301e6b6e4cb5184cb
-
SHA1
d9912927633c0d7f95edab4a8cabacccf7ab58d6
-
SHA256
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e
-
SHA512
0fe24aa7fee463d2dc4bbcb628210bbbebc8f09495766a116da7e2ae9622daaa9d6a9a8ac2eda206a378987ec975f7cd87249d376b9775aef7fc820a7a07a027
-
SSDEEP
3072:42w44jo5hGz+SbvmhBGNm0T3eLQFbAwQeeyGACS:4HLyXG6H0TUGg
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1084 Process not Found -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2176 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe 2176 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found 1084 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2176 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe"C:\Users\Admin\AppData\Local\Temp\edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2176