Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    41s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/12/2022, 02:33 UTC

General

  • Target

    file.exe

  • Size

    316KB

  • MD5

    f888a176a38549cc9c0bab4424a8fffc

  • SHA1

    1631251a261638c4e6af5908c16bdb27351c7d42

  • SHA256

    2ce5142469202d7bce3b0a656511679d82e61d3e1a125ad968a7f917bb7f872e

  • SHA512

    c07f70dd4cd3e347bf5456e11e8d1da8f6d08c168dabeb94c0423dfae60c649462b9a3d65691c4166b3a1f2de5e43d3165f057c0a338faf4434b3c361fe7853f

  • SSDEEP

    6144:kpLutLEANOntKSCJG9E0WtehpRR0cSpQTtyzsduHNIv:kpStL1NOt7elgLRR0TCtyYduHNI

Malware Config

Signatures

  • Detects Smokeloader packer 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1268-57-0x0000000074F41000-0x0000000074F43000-memory.dmp

    Filesize

    8KB

  • memory/1268-54-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1268-59-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1268-60-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1300-56-0x00000000005DC000-0x00000000005F1000-memory.dmp

    Filesize

    84KB

  • memory/1300-58-0x0000000000230000-0x0000000000239000-memory.dmp

    Filesize

    36KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.