Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 00:56

General

  • Target

    file.exe

  • Size

    350KB

  • MD5

    05aebc8e50bc8f93e9012a06e9fef51c

  • SHA1

    77b424a616fc2a2acbb1d88a4f069a3707befaf7

  • SHA256

    072c8aab1c1044a305f5147378db7d14156de44c34240ccc42a83e620361eeaf

  • SHA512

    4369639a711c4f3b4d6d23b4dcb9efbf32b97f9db7251d6d8b93a6367b314fae7adb68c49240d1acd09bb81fbdd5cda51656b7485066baf0d97103c47b957bdc

  • SSDEEP

    6144:4OaIlKLg8G9QcR+LaJSyua3lbN+BuRyqYILjK:4jUKO9Qz+Vu8NhRXb

Malware Config

Signatures

  • Detects Smokeloader packer 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:5048

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2056-172-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-181-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-140-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-205-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-204-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-203-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-141-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-142-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-143-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-144-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-138-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-146-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-147-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-148-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-149-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-150-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-151-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-152-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-153-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-154-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-155-0x0000000002E20000-0x0000000002E30000-memory.dmp

    Filesize

    64KB

  • memory/2056-156-0x0000000002E30000-0x0000000002E40000-memory.dmp

    Filesize

    64KB

  • memory/2056-157-0x0000000002E30000-0x0000000002E40000-memory.dmp

    Filesize

    64KB

  • memory/2056-158-0x0000000002E30000-0x0000000002E40000-memory.dmp

    Filesize

    64KB

  • memory/2056-159-0x0000000002E30000-0x0000000002E40000-memory.dmp

    Filesize

    64KB

  • memory/2056-160-0x0000000002E30000-0x0000000002E40000-memory.dmp

    Filesize

    64KB

  • memory/2056-161-0x0000000002E30000-0x0000000002E40000-memory.dmp

    Filesize

    64KB

  • memory/2056-162-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-163-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-164-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-165-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-166-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-167-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-168-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-173-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-170-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-145-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-139-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-169-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-174-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-175-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-176-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-177-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-178-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-179-0x00000000023A0000-0x00000000023B0000-memory.dmp

    Filesize

    64KB

  • memory/2056-180-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-171-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-182-0x00000000023A0000-0x00000000023B0000-memory.dmp

    Filesize

    64KB

  • memory/2056-183-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-184-0x00000000029F0000-0x0000000002A00000-memory.dmp

    Filesize

    64KB

  • memory/2056-185-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-186-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-187-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-188-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-189-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-190-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-191-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-192-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-193-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-194-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-195-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-196-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-197-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-198-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-199-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-200-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-201-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/2056-202-0x00000000023A0000-0x00000000023B0000-memory.dmp

    Filesize

    64KB

  • memory/3284-134-0x0000000000847000-0x000000000085D000-memory.dmp

    Filesize

    88KB

  • memory/3284-135-0x0000000000030000-0x0000000000039000-memory.dmp

    Filesize

    36KB

  • memory/5048-133-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/5048-136-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/5048-137-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB