Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05/12/2022, 16:06
General
-
Target
0fe9ad9529723aa84e782fc7a9e4ccd1d2c9720eb544c5f196dad52da65916b2.exe
-
Size
273KB
-
MD5
85cbf9277e814e4b950df45e4a245fab
-
SHA1
d14351d7e63c3f9e2b45c0ba9cd39d94a3ac2635
-
SHA256
0fe9ad9529723aa84e782fc7a9e4ccd1d2c9720eb544c5f196dad52da65916b2
-
SHA512
a7ce87fa09ad6f7ba97e3b55381b0d349a7c3fbbcb9c5798fc8f8a39c1dacb1ec624f8113643782476576af1ef869df0d2a2cbc30a5d0d8ddb98dfcc88266c07
-
SSDEEP
3072:DymXV0t4JYKM05DuYg9Wv56YfsQYT+oGTGBFxxghTDw02rwm91y22ZeXGMh0k:eOhuYghYEQWNGiBDxf02smQe2U
Malware Config
Signatures
-
Detects Smokeloader packer 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 5 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fe9ad9529723aa84e782fc7a9e4ccd1d2c9720eb544c5f196dad52da65916b2.exe"C:\Users\Admin\AppData\Local\Temp\0fe9ad9529723aa84e782fc7a9e4ccd1d2c9720eb544c5f196dad52da65916b2.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6EF6.exeC:\Users\Admin\AppData\Local\Temp\6EF6.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854KB
MD5b5ddd722870b01d4908f72a83c5d5d8b
SHA1e04ff8b6ec35900961d7d34115d77438a5d8db8f
SHA256dd38d9f92b19728b23891ceb5fa2220ab1e87e1b4d783c3111a9b36f7c274537
SHA5120a1647d7d94b0fb94e74aad5becf456d28f4159da57e591fa0c5438db590d767508b7b53ec9ccfb9104a021f4df9add747a264d78d2b0b93f640c8a9baaefdfc
-
Filesize
854KB
MD5b5ddd722870b01d4908f72a83c5d5d8b
SHA1e04ff8b6ec35900961d7d34115d77438a5d8db8f
SHA256dd38d9f92b19728b23891ceb5fa2220ab1e87e1b4d783c3111a9b36f7c274537
SHA5120a1647d7d94b0fb94e74aad5becf456d28f4159da57e591fa0c5438db590d767508b7b53ec9ccfb9104a021f4df9add747a264d78d2b0b93f640c8a9baaefdfc
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
980KB
-
Filesize
644KB
-
Filesize
432KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
432KB
-
Filesize
36KB
-
Filesize
12KB
-
Filesize
12KB