Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
12/02/2023, 18:59
General
-
Target
file.exe
-
Size
188KB
-
MD5
c62d0e6b08372bdf718d93120d3bc68c
-
SHA1
84cd698cf0298a28b13a2cb3102ab63d548ff8dc
-
SHA256
1a28123e32b8df8688f8311cd6f01776ef8a1208ac28501529322ae2ea951e0d
-
SHA512
3fb65e46948228d2aad968f0b7a54d46e108370c69bc77c409a6f131a5865bdd16f42a87a54c4b1d048cb1a8c88245d7ed10b3dbfb8f8442434b269bf83e083a
-
SSDEEP
3072:/7YCa+HuNW56Gq4PzErdzOSrB9c4bKiD6u4YZ6ei:T8Cotz4PYrdz3ZDP4YZ
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\strsjbrC:\Users\Admin\AppData\Roaming\strsjbr1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
MD5c62d0e6b08372bdf718d93120d3bc68c
SHA184cd698cf0298a28b13a2cb3102ab63d548ff8dc
SHA2561a28123e32b8df8688f8311cd6f01776ef8a1208ac28501529322ae2ea951e0d
SHA5123fb65e46948228d2aad968f0b7a54d46e108370c69bc77c409a6f131a5865bdd16f42a87a54c4b1d048cb1a8c88245d7ed10b3dbfb8f8442434b269bf83e083a
-
Filesize
188KB
MD5c62d0e6b08372bdf718d93120d3bc68c
SHA184cd698cf0298a28b13a2cb3102ab63d548ff8dc
SHA2561a28123e32b8df8688f8311cd6f01776ef8a1208ac28501529322ae2ea951e0d
SHA5123fb65e46948228d2aad968f0b7a54d46e108370c69bc77c409a6f131a5865bdd16f42a87a54c4b1d048cb1a8c88245d7ed10b3dbfb8f8442434b269bf83e083a
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
3.5MB
-
Filesize
88KB
-
Filesize
3.5MB
-
Filesize
84KB
-
Filesize
3.5MB
-
Filesize
3.5MB