Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2023, 16:32 UTC

General

  • Target

    file.exe

  • Size

    168KB

  • MD5

    e83e0c1a239a6ee3b168276636256e60

  • SHA1

    e23c097277db3db2a4dbc76f68fade41b15fdf02

  • SHA256

    be48bf98323f33e64fd282edcb5413d86dcd291c073084826e7e89b24dc0b99d

  • SHA512

    0cafb90da246e8dd65786631243d432440d9f6da24219ef4d4cae9eb23f8526d33a8b418813b2f9a249c0927bfaba7c67aec56781245367506e6ef9f8ed78659

  • SSDEEP

    3072:Bn4v5Lq4lw0F52HzjMjWncqOPAnDhRujzebXQ:GLPw0evMjWnDYq9sjys

Malware Config

Signatures

  • Detects Smokeloader packer 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      "C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1632-56-0x0000000002D7B000-0x0000000002D8E000-memory.dmp

    Filesize

    76KB

  • memory/1632-58-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

  • memory/1692-54-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1692-57-0x00000000761F1000-0x00000000761F3000-memory.dmp

    Filesize

    8KB

  • memory/1692-59-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/1692-60-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.