Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/05/2024, 16:36

240528-t4cr2sda92 10

28/05/2024, 07:10

240528-hze6tsbf67 10

Analysis

  • max time kernel
    89s
  • max time network
    99s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/05/2024, 07:10

General

  • Target

    04f4cf2c922257c19f851c4db54a0d8d3533656afaadca73c072f5f7356d3a96.exe

  • Size

    310KB

  • MD5

    bd16fbd0b7ac1b57d95a555cfe978407

  • SHA1

    828fdf61432eb5bcc8d41a7e0dce6d123a51f439

  • SHA256

    04f4cf2c922257c19f851c4db54a0d8d3533656afaadca73c072f5f7356d3a96

  • SHA512

    34d15e968aa21a0a27876177f6731354361f7d328e7d3f7a8418ebdbc0f3b80115fb0db157f4b208b81325cfd9a83e019e5b3e4bbb50247577faee01ebb6330c

  • SSDEEP

    6144:KuL3KBWvmKm9BHNxwSMDC8+gtP04/raobG7LTlcM:Ku7DvmKm9Bjt8Dt8Mai6VcM

Malware Config

Extracted

Family

smokeloader

Botnet

pub3

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\04f4cf2c922257c19f851c4db54a0d8d3533656afaadca73c072f5f7356d3a96.exe
    "C:\Users\Admin\AppData\Local\Temp\04f4cf2c922257c19f851c4db54a0d8d3533656afaadca73c072f5f7356d3a96.exe"
    1⤵
    • Checks SCSI registry key(s)
    PID:3192
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 384
      2⤵
      • Program crash
      PID:3340
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3192 -ip 3192
    1⤵
      PID:4968

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3192-2-0x0000000002DC0000-0x0000000002DCB000-memory.dmp

      Filesize

      44KB

    • memory/3192-1-0x0000000002DD0000-0x0000000002ED0000-memory.dmp

      Filesize

      1024KB

    • memory/3192-3-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3192-5-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/3192-4-0x0000000000400000-0x0000000002CAC000-memory.dmp

      Filesize

      40.7MB