Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
440s -
max time network
442s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2025, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
traf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
traf.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
traf.exe
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral4
Sample
traf.exe
Resource
win11-20241007-en
General
-
Target
traf.exe
-
Size
13KB
-
MD5
77947379b9e26603db5a24e63d9e68fc
-
SHA1
7f4f613ab87573b7d69b66b0fedb01db65878961
-
SHA256
4d2bed7b84733fd0b18cdc6c01aa7518d62981d4d0e633c00caa648d0e188937
-
SHA512
50601dd57160732f1d3e4f6b27a77e5bf4d06ce51e5d35454550c3c9b45662e28a2ada3f6f60541c622131f28c84e7c6cabf2adf1e29d0294b058536d1a0953a
-
SSDEEP
192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4Ot0O:JAnLAXNy/m3/bTK0O
Malware Config
Extracted
smokeloader
2017
http://dogewareservice.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum traf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 traf.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2656 1944 WerFault.exe 86 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language traf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe 324 traf.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 324 traf.exe 324 traf.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 324 wrote to memory of 1944 324 traf.exe 86 PID 324 wrote to memory of 1944 324 traf.exe 86 PID 324 wrote to memory of 1944 324 traf.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\traf.exe"C:\Users\Admin\AppData\Local\Temp\traf.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 9803⤵
- Program crash
PID:2656
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1944 -ip 19441⤵PID:3928