Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    37s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/01/2025, 21:31

General

  • Target

    8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.zip

  • Size

    238KB

  • MD5

    ba8922e305f3a82189a11d16a89425e5

  • SHA1

    0817b9d3a52cec931412d3aaf051cac9920488c1

  • SHA256

    9da80a2df494991e943f4da6d547e9355ab42cc6e7af8ddd462133a59f8af240

  • SHA512

    2bdd1039a62eea99d95323506efbc5cd0ac1e4388b3e7ce99cc58897b9fb123032ed12018bf391f1911a7b70529976eec2aabd84ace129e0cf81771ec029b57c

  • SSDEEP

    6144:HFkJho0+oePGm92wWV/o7IIGcjonuCq9mZetODD8u:mNm9Ii9GcjfkZQODDR

Malware Config

Extracted

Family

smokeloader

Botnet

pub4

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 34 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2480
  • C:\Users\Admin\Desktop\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe
    "C:\Users\Admin\Desktop\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:1700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1700 -s 484
      2⤵
      • Program crash
      PID:4992
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1700 -ip 1700
    1⤵
      PID:236
    • C:\Windows\system32\control.exe
      "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1420
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:772
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2692
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

      Filesize

      28KB

      MD5

      ee32140367b434c0e35c098ab18d93ce

      SHA1

      00471a6104f3d2076656e3fede4545cfd8b9c379

      SHA256

      060c7b5945e849c0414c6c7d8741d59032c04b3960d8f6693cf8eae2b00f1b00

      SHA512

      2c5c371b9fec3ce8f07214d439d30d672de1140cd330d3e7ab29911d1d3137283535eb576f7c1812c31ae98c105f1c55c5ef9684b78fe87ff1ae035e476128d9

    • C:\Users\Admin\Desktop\8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0.exe

      Filesize

      309KB

      MD5

      1b62d8c0e8d0eb18d7804a2322aa7533

      SHA1

      27e6a71fc46a75b6ab313f24b42400c18b3b78a4

      SHA256

      8ba0b30450c0c8e065f665ef3a8c1181b5d669480964211a89a20c42e87af1d0

      SHA512

      707356c0e3e9827a27d3c4ba28d7f03cc97245a3d4f18555e2f89686df09178aed742c54b9dd8a978655fd5a61680efa775ce9a6ccac945ebb612bb3e5063e5f

    • memory/1700-10-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1700-6-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1700-5-0x00000000022A0000-0x00000000022AB000-memory.dmp

      Filesize

      44KB

    • memory/1700-9-0x00000000022A0000-0x00000000022AB000-memory.dmp

      Filesize

      44KB

    • memory/1700-7-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/1700-8-0x00000000022D0000-0x00000000022FC000-memory.dmp

      Filesize

      176KB

    • memory/1700-4-0x00000000022D0000-0x00000000022FC000-memory.dmp

      Filesize

      176KB

    • memory/3460-13-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-14-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-12-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-22-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-24-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-23-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-21-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-19-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-20-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB

    • memory/3460-18-0x0000022E60660000-0x0000022E60661000-memory.dmp

      Filesize

      4KB