Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25/10/2022, 00:48
General
-
Target
715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299.exe
-
Size
220KB
-
MD5
07ccf82355aa0f7c864429c757d9d8ba
-
SHA1
7f15f044a8607d4671b7dd054500bd047de6f630
-
SHA256
715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299
-
SHA512
a7850cd16234c6543038930d9601c78ccd8a68482d35679ee10844b080d93c595a63e3930393f39b21495630b86321efc95aa612ed5e84cc3d59bd40e6ca873c
-
SSDEEP
3072:53205dVETW/rWLLTLsws6H5LXQkGxH0XMidzyf424ew8UVhQbo/7FB8eSe:53TJmLTPsMQkGxH6Mityf+eIVhh77Y
Malware Config
Signatures
-
Detects Smokeloader packer 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299.exe"C:\Users\Admin\AppData\Local\Temp\715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299.exe"C:\Users\Admin\AppData\Local\Temp\715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Roaming\estritgC:\Users\Admin\AppData\Roaming\estritg1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\estritgC:\Users\Admin\AppData\Roaming\estritg2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD507ccf82355aa0f7c864429c757d9d8ba
SHA17f15f044a8607d4671b7dd054500bd047de6f630
SHA256715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299
SHA512a7850cd16234c6543038930d9601c78ccd8a68482d35679ee10844b080d93c595a63e3930393f39b21495630b86321efc95aa612ed5e84cc3d59bd40e6ca873c
-
Filesize
220KB
MD507ccf82355aa0f7c864429c757d9d8ba
SHA17f15f044a8607d4671b7dd054500bd047de6f630
SHA256715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299
SHA512a7850cd16234c6543038930d9601c78ccd8a68482d35679ee10844b080d93c595a63e3930393f39b21495630b86321efc95aa612ed5e84cc3d59bd40e6ca873c
-
Filesize
220KB
MD507ccf82355aa0f7c864429c757d9d8ba
SHA17f15f044a8607d4671b7dd054500bd047de6f630
SHA256715b64fe6d295af97dc23676fd41978b09614c5bd78194151ed8066350ff0299
SHA512a7850cd16234c6543038930d9601c78ccd8a68482d35679ee10844b080d93c595a63e3930393f39b21495630b86321efc95aa612ed5e84cc3d59bd40e6ca873c
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB