Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 17:51

General

  • Target

    6a7dce505e0b3c2986f1b895c401c1f4.exe

  • Size

    300KB

  • MD5

    6a7dce505e0b3c2986f1b895c401c1f4

  • SHA1

    bf2b8f824b1d3e790d9ee17f6f91fbec1720dfbc

  • SHA256

    1bc77d71c5c8030ff0a59f02a18cbe036682f100490106bd78b6fe4a470076e1

  • SHA512

    a2651e12f90ddefee1230ba7c2b454912d973654ab3ac64fd92ef7923f9b59e971af20fafb33498658a8f357c37ace37716801c16c58b1f49e8408ea559e387a

  • SSDEEP

    6144:3S8scbJ3k4mIFrTJaHRBXb3J1eigavwVf:3WcBk4FHJaHPb51T

Malware Config

Signatures

  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6a7dce505e0b3c2986f1b895c401c1f4.exe
    "C:\Users\Admin\AppData\Local\Temp\6a7dce505e0b3c2986f1b895c401c1f4.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2020-55-0x0000000075451000-0x0000000075453000-memory.dmp

    Filesize

    8KB

  • memory/2020-56-0x0000000000230000-0x0000000000330000-memory.dmp

    Filesize

    1024KB

  • memory/2020-57-0x00000000003A0000-0x00000000003A9000-memory.dmp

    Filesize

    36KB

  • memory/2020-58-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2020-59-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB