Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3SmokeySpoo...in.zip
windows7-x64
1SmokeySpoo...in.zip
windows10-2004-x64
1SmokeySpoo...ICENSE
windows7-x64
1SmokeySpoo...ICENSE
windows10-2004-x64
1SmokeySpoo...DME.md
windows7-x64
3SmokeySpoo...DME.md
windows10-2004-x64
3SmokeySpoo...config
windows7-x64
3SmokeySpoo...config
windows10-2004-x64
3SmokeySpoo...ner.cs
windows7-x64
3SmokeySpoo...ner.cs
windows10-2004-x64
3SmokeySpoo...uth.js
windows7-x64
3SmokeySpoo...uth.js
windows10-2004-x64
3SmokeySpoo...th.vbs
windows7-x64
1SmokeySpoo...th.vbs
windows10-2004-x64
1SmokeySpoo...go.ico
windows7-x64
3SmokeySpoo...go.ico
windows10-2004-x64
3SmokeySpoo...ner.cs
windows7-x64
3SmokeySpoo...ner.cs
windows10-2004-x64
3SmokeySpoo...ain.cs
windows7-x64
3SmokeySpoo...ain.cs
windows10-2004-x64
3SmokeySpoo...in.vbs
windows7-x64
1SmokeySpoo...in.vbs
windows10-2004-x64
1SmokeySpoo...ram.cs
windows7-x64
3SmokeySpoo...ram.cs
windows10-2004-x64
3SmokeySpoo...nfo.cs
windows7-x64
3SmokeySpoo...nfo.cs
windows10-2004-x64
3SmokeySpoo...er.vbs
windows7-x64
1SmokeySpoo...er.vbs
windows10-2004-x64
1SmokeySpoo...es.vbs
windows7-x64
1SmokeySpoo...es.vbs
windows10-2004-x64
1SmokeySpoo...ner.cs
windows7-x64
3SmokeySpoo...ner.cs
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
SmokeySpoofer-main.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SmokeySpoofer-main.zip
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
SmokeySpoofer-main/LICENSE
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
SmokeySpoofer-main/LICENSE
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
SmokeySpoofer-main/README.md
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
SmokeySpoofer-main/README.md
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
SmokeySpoofer-main/SmokeySpoofer/App.config
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
SmokeySpoofer-main/SmokeySpoofer/App.config
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
SmokeySpoofer-main/SmokeySpoofer/Auth.Designer.cs
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
SmokeySpoofer-main/SmokeySpoofer/Auth.Designer.cs
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
SmokeySpoofer-main/SmokeySpoofer/Auth.js
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
SmokeySpoofer-main/SmokeySpoofer/Auth.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
SmokeySpoofer-main/SmokeySpoofer/Auth.vbs
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
SmokeySpoofer-main/SmokeySpoofer/Auth.vbs
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
SmokeySpoofer-main/SmokeySpoofer/Logo.ico
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
SmokeySpoofer-main/SmokeySpoofer/Logo.ico
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
SmokeySpoofer-main/SmokeySpoofer/Main.Designer.cs
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
SmokeySpoofer-main/SmokeySpoofer/Main.Designer.cs
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
SmokeySpoofer-main/SmokeySpoofer/Main.cs
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
SmokeySpoofer-main/SmokeySpoofer/Main.cs
Resource
win10v2004-20240704-en
Behavioral task
behavioral21
Sample
SmokeySpoofer-main/SmokeySpoofer/Main.vbs
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
SmokeySpoofer-main/SmokeySpoofer/Main.vbs
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
SmokeySpoofer-main/SmokeySpoofer/Program.cs
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
SmokeySpoofer-main/SmokeySpoofer/Program.cs
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/AssemblyInfo.cs
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/AssemblyInfo.cs
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/Resources.Designer.vbs
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/Resources.Designer.vbs
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/Resources.vbs
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/Resources.vbs
Resource
win10v2004-20240708-en
Behavioral task
behavioral31
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/Settings.Designer.cs
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
SmokeySpoofer-main/SmokeySpoofer/Properties/Settings.Designer.cs
Resource
win10v2004-20240704-en
General
-
Target
SmokeySpoofer-main/SmokeySpoofer/Main.cs
-
Size
25KB
-
MD5
e18b9d4844a0e2526a427720115ee569
-
SHA1
18d553d3ecfd6ff3451f166473f8f7121468882f
-
SHA256
84dd3f1a32e611270322f5323e3d853145b78bbb463dbacec6777e65a2cea66c
-
SHA512
90ace917d3bf9ed775ad04dabe9bac4a2b798c4fb21920a6330ae8cabe9ac14869a93d7f831dd4bb965beac3adc2814cc444ca8b659a047db3ad93edb3e3db40
-
SSDEEP
768:6+W636xBoT2pbdzwZefxDtYDmZApuvruMh5i6Yj:6+W636xBoT2pbdzwZefxDtYDmZApuvrw
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2508 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2508 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2508 AcroRd32.exe 2508 AcroRd32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1772 wrote to memory of 2508 1772 cmd.exe 29 PID 1772 wrote to memory of 2508 1772 cmd.exe 29 PID 1772 wrote to memory of 2508 1772 cmd.exe 29 PID 1772 wrote to memory of 2508 1772 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SmokeySpoofer-main\SmokeySpoofer\Main.cs1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SmokeySpoofer-main\SmokeySpoofer\Main.cs"2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2508
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f87b02d27d71408a7f4de2d28d654aa6
SHA1d0f22cf7f28ceae8e44f4996282fb84acd6f19c0
SHA25620794a5531b44f454d756f8c7ab4f5f9c57a15c2b8043a4c962cdac6a7d9ede6
SHA512d4852bc4cc7437bd9bb7dbdc0b1cbfcceef1917bbd2d91be2cd2bac4f5058da3ac30c827f8dcc6419531cf335d3038cb8b825c2b2e08f700602ce1895beff612