Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
440s -
max time network
442s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/01/2025, 01:34
General
-
Target
traf.exe
-
Size
13KB
-
MD5
77947379b9e26603db5a24e63d9e68fc
-
SHA1
7f4f613ab87573b7d69b66b0fedb01db65878961
-
SHA256
4d2bed7b84733fd0b18cdc6c01aa7518d62981d4d0e633c00caa648d0e188937
-
SHA512
50601dd57160732f1d3e4f6b27a77e5bf4d06ce51e5d35454550c3c9b45662e28a2ada3f6f60541c622131f28c84e7c6cabf2adf1e29d0294b058536d1a0953a
-
SSDEEP
192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4Ot0O:JAnLAXNy/m3/bTK0O
Malware Config
Extracted
smokeloader
2017
http://dogewareservice.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\traf.exe"C:\Users\Admin\AppData\Local\Temp\traf.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 9803⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1944 -ip 19441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
20KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
40KB
-
Filesize
40KB