Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 13:26

General

  • Target

    e38254f4751330b832d45e58fa4806112ad619f3a0a8264b727ae0bdf48739ef.exe

  • Size

    258KB

  • MD5

    fde473ceb572a8007b61e5e80beef538

  • SHA1

    fe98b27b40a5a59246f1befccf38bb05e554e4c1

  • SHA256

    e38254f4751330b832d45e58fa4806112ad619f3a0a8264b727ae0bdf48739ef

  • SHA512

    65985fc6c11d62bcf8d49aff0360a743deaad31c4cda4998b1bf9e1f7da585124253e7258d3d5c516ad2149b37e3f61fe5cd188c265d5f756d0e52bb3aa448fd

  • SSDEEP

    3072:aXBRMLRpkC0h5RQlABhdlBuaetqh/jcNf7lrR5hTfCT7Lipvr:dz0hA/aalKripv

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e38254f4751330b832d45e58fa4806112ad619f3a0a8264b727ae0bdf48739ef.exe
    "C:\Users\Admin\AppData\Local\Temp\e38254f4751330b832d45e58fa4806112ad619f3a0a8264b727ae0bdf48739ef.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:2352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2352 -s 352
      2⤵
      • Program crash
      PID:436
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2352 -ip 2352
    1⤵
      PID:740

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2352-1-0x00000000006C0000-0x00000000007C0000-memory.dmp

      Filesize

      1024KB

    • memory/2352-2-0x0000000000600000-0x000000000060B000-memory.dmp

      Filesize

      44KB

    • memory/2352-3-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/2352-4-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/2352-5-0x0000000000600000-0x000000000060B000-memory.dmp

      Filesize

      44KB

    • memory/2352-6-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB