Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
4f132cd93fe858362c4feb4d4effd90a.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4f132cd93fe858362c4feb4d4effd90a.exe
Resource
win10v2004-20240802-en
General
-
Target
4f132cd93fe858362c4feb4d4effd90a.exe
-
Size
208KB
-
MD5
4f132cd93fe858362c4feb4d4effd90a
-
SHA1
6227cb221e604ec4d9c0e00a2d0ced0fb14a23fc
-
SHA256
82d99b840ac392300eb572ed71f77b62278361bce95488e24b0f53de4d67ad8c
-
SHA512
8dffd1a9fb21bae9bbf0153887d60e20fbcab86452e654e4ed2b66a993f91af48e520751bcd3535949e37eb4976aec057bb1710b27f610ef40d96d71100ffc68
-
SSDEEP
3072:+XSI/Bv48I9DWF/VLVqY81GcPE5EZRrBLrcJ7itM:+XcX9DWB1ZtarFgJ
Malware Config
Extracted
smokeloader
pub1
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Program crash 1 IoCs
pid pid_target Process procid_target 668 1732 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f132cd93fe858362c4feb4d4effd90a.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4f132cd93fe858362c4feb4d4effd90a.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4f132cd93fe858362c4feb4d4effd90a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4f132cd93fe858362c4feb4d4effd90a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f132cd93fe858362c4feb4d4effd90a.exe"C:\Users\Admin\AppData\Local\Temp\4f132cd93fe858362c4feb4d4effd90a.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:1732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 3522⤵
- Program crash
PID:668
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1732 -ip 17321⤵PID:972