Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/03/2025, 18:58

250301-xmhhrayp15 10

01/03/2025, 18:55

250301-xkqrcaypx7 10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/02/2025, 00:12

General

  • Target

    HYDRA.exe

  • Size

    2.6MB

  • MD5

    c52bc39684c52886712971a92f339b23

  • SHA1

    c5cb39850affb7ed322bfb0a4900e17c54f95a11

  • SHA256

    f8c17cb375e8ccad5b0e33dae65694a1bd628f91cac6cf65dd11f50e91130c2d

  • SHA512

    2d50c1aa6ca237b9dbe97f000a082a223618f2164c8ab42ace9f4e142c318b2fc53e91a476dbe9c2dd459942b61507df5c551bd5c692a2b2a2037e4f6bd2a12b

  • SSDEEP

    49152:HnUXzRe4cjAx+L/G/3JHQZutOnmSzZniyui0EJHezdcc/DK9kTO1S:HUD8djA0LOvJdtOmSlniyuiPFePmS61S

Malware Config

Extracted

Family

smokeloader

Version

2017

C2

http://92.53.105.14/

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Smokeloader family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 12 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 21 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HYDRA.exe
    "C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Users\Admin\AppData\Roaming\yaya.exe
      C:\Users\Admin\AppData\Roaming\yaya.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
        "C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2940
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lo7wkema.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2612
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA71.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCA70.tmp"
            5⤵
              PID:2152
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe"
            4⤵
              PID:956
            • C:\Windows\System32\cmd.exe
              /K services.exe && clear
              4⤵
                PID:2964
              • C:\Windows\System32\cmd.exe
                /K services.exe && clear
                4⤵
                  PID:2492
                • C:\Windows\System32\cmd.exe
                  /K services.exe && clear
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:572
                  • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
                    services.exe
                    5⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:408
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe"
                  4⤵
                    PID:1960
                  • C:\Windows\System32\cmd.exe
                    net localgroup administrators %username% /add
                    4⤵
                      PID:1544
                • C:\Users\Admin\AppData\Roaming\va.exe
                  C:\Users\Admin\AppData\Roaming\va.exe
                  2⤵
                  • Drops startup file
                  • Executes dropped EXE
                  PID:2316
                • C:\Users\Admin\AppData\Roaming\ufx.exe
                  C:\Users\Admin\AppData\Roaming\ufx.exe
                  2⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:272
                  • C:\ProgramData\ucp\usc.exe
                    "C:\ProgramData\ucp\usc.exe" /ucp/usc.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1764
                    • C:\Windows\SysWOW64\SCHTASKS.exe
                      SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exe
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Scheduled Task/Job: Scheduled Task
                      PID:2872
                • C:\Users\Admin\AppData\Roaming\sant.exe
                  C:\Users\Admin\AppData\Roaming\sant.exe
                  2⤵
                  • Executes dropped EXE
                  • Maps connected drives based on registry
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of WriteProcessMemory
                  PID:1584
                  • C:\Windows\SysWOW64\explorer.exe
                    explorer.exe
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1536
                • C:\Users\Admin\AppData\Roaming\power.exe
                  C:\Users\Admin\AppData\Roaming\power.exe
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2724
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2356
              • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
                C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2116
                • C:\Windows\TEMP\foxcon.exe
                  "C:\Windows\TEMP\foxcon.exe"
                  2⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1608

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\RESCA71.tmp

                Filesize

                1KB

                MD5

                ee70e29d2db096c98276d191b6d1a07b

                SHA1

                1b265e31adcd3c50b350b8b83402eab7c71a5cb5

                SHA256

                6983a61384cc010764de1c98b644a7012c7199c861d762978feb37d85129b7bc

                SHA512

                404d23d3228ca7cba8cc94ff703a9881e8cbe953dcae49e219ddd483020ba2fd13aa78713b28f74b03716f72c8e330718cf401bc05494739e6b56d82672369dc

              • C:\Users\Admin\AppData\Local\Temp\lo7wkema.dll

                Filesize

                5KB

                MD5

                4c677c4422b66ce1a4f27eef782f0b08

                SHA1

                c12639c1f4f76dafd4eb06a01fa46f02879923fc

                SHA256

                ce75548f540236f910d1af78965d8edfc0f3c9086b84a2dd43c104570adb7bd6

                SHA512

                02ce411bfd5225597b96fb874bd81e98181e2381ca298355a36d6a915a0990c43d8e037c8955d466e4edc0b8acb5cdf6689d0180c41624db912779c4372e375c

              • C:\Users\Admin\AppData\Local\Temp\lo7wkema.pdb

                Filesize

                7KB

                MD5

                c334a405811d946e88234b5c70189b6f

                SHA1

                13707d185bd770776d1cced87d5c9aa3a07dc8e8

                SHA256

                a25dcd641a483541cb40c83647fb00a888804b42df3ebec9453acd725318298a

                SHA512

                df31c041054ed9d2698c77135323af0c83ba6790d9cbfc2c3366a5ead8be5ba69c7fe5698faca94f60375bcfe0f51f50069ccccd265680be5676136278049628

              • C:\Users\Admin\AppData\Roaming\ufx.exe

                Filesize

                960KB

                MD5

                22e088012519e1013c39a3828bda7498

                SHA1

                3a8a87cce3f6aff415ee39cf21738663c0610016

                SHA256

                9e3826138bacac89845c26278f52854117db1652174c1c76dbb2bd24f00f4973

                SHA512

                5559e279dd3d72b2c9062d88e99212bbc67639fe5a42076efd24ae890cfce72cfe2235adb20bf5ed1f547b6da9e69effa4ccb80c0407b7524f134a24603ea5a8

              • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\Newtonsoft.Json.dll

                Filesize

                487KB

                MD5

                0c33e2f116aaa66d0012a8376d82ce29

                SHA1

                81cd6b87a9f7b4a174138312986d682f464067f4

                SHA256

                9a19ef049430af9ac49ff719cbfb73dc6c6b0d0ef53914479dd282260771518b

                SHA512

                b19dceb47d943bcb40f185e232eb1a0f665f6b6107e6c83c0f0a1aa80013b2756c5a831f3413a4c57ca37f7ec4a95a173e1f3d67e49f1fff2071273acc538317

              • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\foxcon.exe

                Filesize

                15KB

                MD5

                7b07728b813d26228f10f6cdb7ac8471

                SHA1

                48418d83ac372c1398753f7a766076750a03a725

                SHA256

                7e5a9baf4d9ead35e1d9a3b3dda6ee05e670bd721500d82fbf08e1e8091fa911

                SHA512

                f8a1070d4a0297151c6d55e60bc953a985b82159920e5a6a3a40270f0ad7e06edb1815b6fed1313076f7f6bbf32155d22a5a0e605378525aa3a9055a2c7128aa

              • C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe

                Filesize

                27KB

                MD5

                63602f11993c01a4b36f42187a797128

                SHA1

                d6c761942dcb32190f924ea7490acc38865f7300

                SHA256

                2c926cd6c980ff89ced8de49a8d0e7fb7247f58b1face21a1e9883a58b822b84

                SHA512

                1a13649d6d5917d132f85cae9af206b1959578134db392afd6fec0c68ff1828c87daa2a537678ad1a83c0e273fed7f154f6f6f6f72102733fa6626bcd57ded0e

              • \??\c:\Users\Admin\AppData\Local\Temp\CSCCA70.tmp

                Filesize

                652B

                MD5

                d7fb0e5b7dd62f24ca8f194d0e7dc9de

                SHA1

                497dd0661ebf99bd53d1b7824d4a478c49a5ba8b

                SHA256

                4b90cf73cdd38f6645e1f1d3ee804c896066ab0aa372744a5af8565952c67e98

                SHA512

                cd9424e09c85b6773596dc6810387c393a616c8bd471b179d6ed2d434d5e28eff5631ba1a559dc485ee572998d868f2be2a2ff6e9b153db9ab1cb83f460a907e

              • \??\c:\Users\Admin\AppData\Local\Temp\lo7wkema.0.cs

                Filesize

                4KB

                MD5

                a0d1b6f34f315b4d81d384b8ebcdeaa5

                SHA1

                794c1ff4f2a28e0c631a783846ecfffdd4c7ae09

                SHA256

                0b3a3f8f11eb6f50fe67943f2b73c5824614f31c2e0352cc234927d7cb1a52e0

                SHA512

                0a89293d731c5bca05e73148f85a740b324fc877f2fb05cde1f68e2098329fbca552d78249a46f4a1da15a450c8e754c73be20c652f7089d5cfec445ce950a0e

              • \??\c:\Users\Admin\AppData\Local\Temp\lo7wkema.cmdline

                Filesize

                309B

                MD5

                98febffda4606c2b26956277670cfe12

                SHA1

                af91d5bfea475edafab826c589448ff682a7008e

                SHA256

                afcc6168e351a2a69dccb6012307a0e1ba00ad36347111f5b463c86da40b0f21

                SHA512

                7c62129b293318d1648e001140170cf5e057f02f787891a98e85536e9d637ff035c47ca35c42579e5d33b19abb6df6581b04e11b37b445b7d53b6c82461059cf

              • \ProgramData\ucp\usc.exe

                Filesize

                4.0MB

                MD5

                b100b373d645bf59b0487dbbda6c426d

                SHA1

                44a4ad2913f5f35408b8c16459dcce3f101bdcc7

                SHA256

                84d7fd0a93d963e9808212917f79fe2d485bb7fbc94ee374a141bbd15da725b7

                SHA512

                69483fed79f33da065b1cc65a2576ba268c78990545070f6f76fca8f48aaec8274faecdc9bcf92bf84a87809a318b159d1a3c835f848a6eea6c163f41612bf9b

              • \Users\Admin\AppData\Roaming\power.exe

                Filesize

                507KB

                MD5

                743f47ae7d09fce22d0a7c724461f7e3

                SHA1

                8e98dd1efb70749af72c57344aab409fb927394e

                SHA256

                1bee45423044b5a6bf0ad0dd2870117824b000784ce81c5f8a1b930bb8bc0465

                SHA512

                567993c3b798365efa07b7a46fda98494bfe540647f27654764e78b7f60f093d403b77b9abb889cfb09b44f13515ce3c041fc5db05882418313c3b3409dd77bf

              • \Users\Admin\AppData\Roaming\sant.exe

                Filesize

                12KB

                MD5

                5effca91c3f1e9c87d364460097f8048

                SHA1

                28387c043ab6857aaa51865346046cf5dc4c7b49

                SHA256

                3fd826fc0c032721466b94ab3ec7dcfe006cc284e16132af6b91dfbc064b0907

                SHA512

                b0dba30fde295d3f7858db9d1463239b30cd84921971032b2afb96f811a53ac12c1e6f72013d2eff397b0b89c371e7c023c951cd2102f94157cba9918cd2c3e0

              • \Users\Admin\AppData\Roaming\va.exe

                Filesize

                88KB

                MD5

                c084e736931c9e6656362b0ba971a628

                SHA1

                ef83b95fc645ad3a161a19ccef3224c72e5472bd

                SHA256

                3139bf3c4b958c3a019af512aecdb8161b9d6d7432d2c404abda3f42b63f34f1

                SHA512

                cbd6485840a117b52e24586da536cefa94ca087b41eb460d27bc2bd320217957c9e0e96b0daf74343efde2e23a5242e7a99075aabf5f9e18e03b52eb7151ae1f

              • \Users\Admin\AppData\Roaming\yaya.exe

                Filesize

                1.7MB

                MD5

                7d05ab95cfe93d84bc5db006c789a47f

                SHA1

                aa4aa0189140670c618348f1baad877b8eca04a4

                SHA256

                5c32e0d2a69fd77e85f2eecaabeb677b6f816de0d82bf7c29c9d124a818f424f

                SHA512

                40d1461e68994df56f19d9f7b2d96ffdc5300ca933e10dc53f7953471df8dea3aabeb178c3432c6819175475cadcbdb698384e3df57b3606c6fce3173a31fe84

              • \Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe

                Filesize

                80KB

                MD5

                51bf85f3bf56e628b52d61614192359d

                SHA1

                c1bc90be6a4beb67fb7b195707798106114ec332

                SHA256

                990dffdc0694858514d6d7ff7fff5dc9f48fab3aa35a4d9301d94fc57e346446

                SHA512

                131173f3aabcfba484e972424c54201ec4b1facfb2df1efe08df0d43a816d4df03908b006884564c56a6245badd4f9ed442a295f1db2c0c970a8f80985d35474

              • memory/1536-105-0x0000000000D40000-0x0000000000FC1000-memory.dmp

                Filesize

                2.5MB

              • memory/1536-106-0x0000000000080000-0x000000000008A000-memory.dmp

                Filesize

                40KB

              • memory/1584-33-0x0000000000400000-0x0000000000404000-memory.dmp

                Filesize

                16KB

              • memory/1584-56-0x0000000000030000-0x000000000003A000-memory.dmp

                Filesize

                40KB

              • memory/1584-109-0x0000000000030000-0x000000000003A000-memory.dmp

                Filesize

                40KB

              • memory/1584-111-0x0000000000400000-0x0000000000404000-memory.dmp

                Filesize

                16KB

              • memory/1868-59-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/2088-30-0x0000000000310000-0x0000000000314000-memory.dmp

                Filesize

                16KB

              • memory/2088-24-0x0000000000310000-0x0000000000314000-memory.dmp

                Filesize

                16KB

              • memory/2116-101-0x0000000019E20000-0x0000000019EA0000-memory.dmp

                Filesize

                512KB

              • memory/2316-14-0x0000000000400000-0x000000000041C000-memory.dmp

                Filesize

                112KB

              • memory/2724-102-0x0000000000400000-0x0000000000485000-memory.dmp

                Filesize

                532KB

              • memory/2940-87-0x0000000000D00000-0x0000000000D08000-memory.dmp

                Filesize

                32KB