Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
37s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/01/2025, 21:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.zip
Resource
win11-20241007-en
windows11-21h2-x64
15 signatures
900 seconds
General
-
Target
8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.zip
-
Size
238KB
-
MD5
ba8922e305f3a82189a11d16a89425e5
-
SHA1
0817b9d3a52cec931412d3aaf051cac9920488c1
-
SHA256
9da80a2df494991e943f4da6d547e9355ab42cc6e7af8ddd462133a59f8af240
-
SHA512
2bdd1039a62eea99d95323506efbc5cd0ac1e4388b3e7ce99cc58897b9fb123032ed12018bf391f1911a7b70529976eec2aabd84ace129e0cf81771ec029b57c
-
SSDEEP
6144:HFkJho0+oePGm92wWV/o7IIGcjonuCq9mZetODD8u:mNm9Ii9GcjfkZQODDR
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pub4
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Smokeloader family
-
Executes dropped EXE 1 IoCs
pid Process 1700 8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4992 1700 WerFault.exe 79 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 34 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 1e00718000000000000000000000e1a40ed25739d211a40b0c50205241530000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \Registry\User\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\NotificationData explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "287309825" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings control.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 0c0001008421de39050000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f706806ee260aa0d7449371beb064c986830000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Key created \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2692 explorer.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeRestorePrivilege 2480 7zFM.exe Token: 35 2480 7zFM.exe Token: SeSecurityPrivilege 2480 7zFM.exe Token: SeShutdownPrivilege 1420 control.exe Token: SeCreatePagefilePrivilege 1420 control.exe Token: SeDebugPrivilege 3460 taskmgr.exe Token: SeSystemProfilePrivilege 3460 taskmgr.exe Token: SeCreateGlobalPrivilege 3460 taskmgr.exe Token: 33 3460 taskmgr.exe Token: SeIncBasePriorityPrivilege 3460 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2480 7zFM.exe 2480 7zFM.exe 2692 explorer.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe 3460 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2692 wrote to memory of 3460 2692 explorer.exe 89 PID 2692 wrote to memory of 3460 2692 explorer.exe 89
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2480
-
C:\Users\Admin\Desktop\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe"C:\Users\Admin\Desktop\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:1700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 4842⤵
- Program crash
PID:4992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1700 -ip 17001⤵PID:236
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
PID:772
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5ee32140367b434c0e35c098ab18d93ce
SHA100471a6104f3d2076656e3fede4545cfd8b9c379
SHA256060c7b5945e849c0414c6c7d8741d59032c04b3960d8f6693cf8eae2b00f1b00
SHA5122c5c371b9fec3ce8f07214d439d30d672de1140cd330d3e7ab29911d1d3137283535eb576f7c1812c31ae98c105f1c55c5ef9684b78fe87ff1ae035e476128d9
-
Filesize
309KB
MD51b62d8c0e8d0eb18d7804a2322aa7533
SHA127e6a71fc46a75b6ab313f24b42400c18b3b78a4
SHA2568ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0
SHA512707356c0e3e9827a27d3c4ba28d7f03cc97245a3d4f18555e2f89686df09178aed742c54b9dd8a978655fd5a61680efa775ce9a6ccac945ebb612bb3e5063e5f