Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30068388548...96.exe
windows10-2004-x64
1013243e4dd5...33.exe
windows10-2004-x64
10202040bebe...98.exe
windows10-2004-x64
103a1c464610...ff.exe
windows10-2004-x64
10556fc723a7...10.exe
windows10-2004-x64
75eb8ed45ba...01.exe
windows10-2004-x64
10663bf6b48c...37.exe
windows10-2004-x64
767dbedea2e...69.exe
windows10-2004-x64
107e4d47aad3...11.exe
windows10-2004-x64
10820ec15efb...db.exe
windows10-2004-x64
1088a5b8b09a...44.exe
windows10-2004-x64
109c0f7f6495...f7.exe
windows10-2004-x64
10bd0a957eae...c0.exe
windows7-x64
10bd0a957eae...c0.exe
windows10-2004-x64
10c8e229c276...39.exe
windows10-2004-x64
10ca2534058c...e4.exe
windows10-2004-x64
10d0c5f92763...68.exe
windows10-2004-x64
10d3f2262a94...31.exe
windows10-2004-x64
10d40527d1f8...ed.exe
windows10-2004-x64
10de4076a039...c9.exe
windows10-2004-x64
10f80bd79907...93.exe
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
24/05/2024, 07:42
Static task
static1
Behavioral task
behavioral1
Sample
0068388548827b89762c020630c0e79519dedb7b7ff6c4f1c625aca59fbf5996.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
13243e4dd58e70de2748aff5360c6262fe2a6de7562acb1334b8a8adbb876f33.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
202040bebe757e0adc39d99b3d7327e79e0354b43f2a6c6fe0d1c1362d3e4198.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
3a1c464610d6f381fd4237273e1990d1b05567b780bacaa50c4d2462441faeff.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
556fc723a7eab0f91113f11d7171070d3875bbfca8f5e2397500b5ee832c0310.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
5eb8ed45ba47d4135feaee11bbc17194ba1e8dfa693a293e370a7725fcfcd401.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
663bf6b48c7a6589e9a0bbabacbb8b22b1556f79bd63892788caae034d162437.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
67dbedea2ea23fd4fe189651241dd1489f71cf6bb5803d660d3d7ecd91ff5669.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
7e4d47aad3f9ebbd9422d69a7b96b1808810801c43b385031da5bd1472cbd411.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
820ec15efb9f2f70d27557121fc2619065a095a0db4a83720d911fc56bc7eedb.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
88a5b8b09ad1e32abc7fce3415b25a2aa7be90802b17e91d650f6961ee4e8744.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
9c0f7f64959c0f4f98391ebbba925fb68cac09522971875cdbdf5e52983343f7.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
c8e229c27623b0e1055a59f9b684a98468f33e92a47da3dcf5b041f74d4eca39.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ca2534058cb45fd1c3c81407733fc01f8031c3b4f9d15b4210c762c631de25e4.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
d0c5f927631e1bb113c5cb5f1178cddd83c9fa595df60b9ffc903fe23c0bcb68.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
d40527d1f87af48fe58a0377e98e5eafc8b6f2ba2f0023257f76d0c61f1096ed.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
de4076a0397d9f3a10c9a7ec7c19d95dd219e5330592bc236b71f5cea26f87c9.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
f80bd799075b9e73bec4964dc911341456e6d8cb065c4ab30d36cb613faf6593.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe
-
Size
270KB
-
MD5
fedcba531f97a219853ff2322af626d0
-
SHA1
b141998a2cf8032e977f2ea8d7a5de8721422c5c
-
SHA256
bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0
-
SHA512
f540b590cb1b2933c928262a57246f32bc9dc1538159870e9a31dbc61fe78ff3d95306c1cba96249ae0c43765981cd7fe41fa289382531a6ce6ca923665a3aff
-
SSDEEP
6144:svpK3RlYo26KFCW8m3JqxAO1A591bVx7:sRK3zZ2tnEbA5
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2464 set thread context of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2080 2464 WerFault.exe 27 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 AppLaunch.exe 836 AppLaunch.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 836 AppLaunch.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 836 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 28 PID 2464 wrote to memory of 2080 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 29 PID 2464 wrote to memory of 2080 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 29 PID 2464 wrote to memory of 2080 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 29 PID 2464 wrote to memory of 2080 2464 bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe"C:\Users\Admin\AppData\Local\Temp\bd0a957eaebb4aaad5274b94282e2e629645d3cfc2d373f90812b885800536c0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 1362⤵
- Program crash
PID:2080
-