Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
Resource
win10v2004-20240226-en
General
-
Target
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe
-
Size
168KB
-
MD5
ec093454a010a3e301e6b6e4cb5184cb
-
SHA1
d9912927633c0d7f95edab4a8cabacccf7ab58d6
-
SHA256
edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e
-
SHA512
0fe24aa7fee463d2dc4bbcb628210bbbebc8f09495766a116da7e2ae9622daaa9d6a9a8ac2eda206a378987ec975f7cd87249d376b9775aef7fc820a7a07a027
-
SSDEEP
3072:42w44jo5hGz+SbvmhBGNm0T3eLQFbAwQeeyGACS:4HLyXG6H0TUGg
Malware Config
Extracted
smokeloader
pub3
Extracted
smokeloader
2022
http://sjyey.com/tmp/index.php
http://babonwo.ru/tmp/index.php
http://mth.com.ua/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 3460 Process not Found -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 848 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe 848 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found 3460 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 848 edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3460 Process not Found 3460 Process not Found 3460 Process not Found -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3460 Process not Found 3460 Process not Found 3460 Process not Found -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe"C:\Users\Admin\AppData\Local\Temp\edc235f5b21f8230e1287d22bd884bc8c36424210b4c14e8e9c2f2e0dedd3f7e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:848