Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
349s -
max time network
410s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27/11/2022, 22:45
General
-
Target
04d85ed0df5a4e1ecb16d8dfa296d5aaa9654b2a39730cb265d0cf684311ecb1.exe
-
Size
167KB
-
MD5
69780ca3e35643f69b0e2d6a4cde8130
-
SHA1
15a3ed86e6dabf55bf2df41bf37b7dcac8611104
-
SHA256
04d85ed0df5a4e1ecb16d8dfa296d5aaa9654b2a39730cb265d0cf684311ecb1
-
SHA512
5f68a3e3ccbb64073f64c5ca2664faa964d0ef12d7f9482b4153a394c30ea1faade4caadf0254920718d47aaa783274f9b3f919f698745869d970abb150c68e0
-
SSDEEP
3072:OtBdw5VsGu2CERRS5hKJBdCcssg6cHuRvHF:i4CG8ERxBdCeg6cO
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d85ed0df5a4e1ecb16d8dfa296d5aaa9654b2a39730cb265d0cf684311ecb1.exe"C:\Users\Admin\AppData\Local\Temp\04d85ed0df5a4e1ecb16d8dfa296d5aaa9654b2a39730cb265d0cf684311ecb1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3EB6.exeC:\Users\Admin\AppData\Local\Temp\3EB6.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD57d9db457b9ad7a4ba3e295d7d57aa700
SHA15b4d68862b7e28eb2db4f53633c28c97a9778bc1
SHA25661861d7235d4a8e8d56e6128865c4f27adb41b631723f79646839c8cc1148c66
SHA51293a7aa69c2906611fbacade03c726030d94bc80d666fa80e8bd7b4e1295482b034e5b77952bae40a9959090ba11fa849c437edddfbd05382f335e71815e0cb06
-
Filesize
3.6MB
MD57d9db457b9ad7a4ba3e295d7d57aa700
SHA15b4d68862b7e28eb2db4f53633c28c97a9778bc1
SHA25661861d7235d4a8e8d56e6128865c4f27adb41b631723f79646839c8cc1148c66
SHA51293a7aa69c2906611fbacade03c726030d94bc80d666fa80e8bd7b4e1295482b034e5b77952bae40a9959090ba11fa849c437edddfbd05382f335e71815e0cb06
-
Filesize
64KB
-
Filesize
36KB
-
Filesize
3.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.0MB