Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
11/01/2023, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
2886716cc6f745cd6f7dd1d0b8550dd3.exe
Resource
win7-20221111-en
windows7-x64
Behavioral task
behavioral2
Sample
2886716cc6f745cd6f7dd1d0b8550dd3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
2886716cc6f745cd6f7dd1d0b8550dd3.exe
-
Size
317KB
-
MD5
2886716cc6f745cd6f7dd1d0b8550dd3
-
SHA1
7947b3637735dc900cb6e23fe7c9a42b0a353c02
-
SHA256
bb96523c156c9c7ad677a2104b085f54647640b1e58ebcf01b4ea4cd35af3a01
-
SHA512
8a14b4d5c47621572719ae78874b5a53cfb72f2e653e5981396913d9666e08a3801338c25abba7cf45a93fb1238a610effc07ad2653561fca4469b85b3e6d1ff
-
SSDEEP
6144:fiJLGme/7lBdaL+6zWoNLIkjF5JqC4RR0cSpQTtyzsduHNIv:qJKd/7lBdS+cJCBRR0TCtyYduHNI
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1640-57-0x00000000003A0000-0x00000000003A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2886716cc6f745cd6f7dd1d0b8550dd3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2886716cc6f745cd6f7dd1d0b8550dd3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2886716cc6f745cd6f7dd1d0b8550dd3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 2886716cc6f745cd6f7dd1d0b8550dd3.exe 1640 2886716cc6f745cd6f7dd1d0b8550dd3.exe 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found 1232 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1232 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1640 2886716cc6f745cd6f7dd1d0b8550dd3.exe