Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09/03/2023, 08:45
Static task
static1
Behavioral task
behavioral1
Sample
f7221f41cd30d868181303763953ddd1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f7221f41cd30d868181303763953ddd1.exe
Resource
win10v2004-20230220-en
General
-
Target
f7221f41cd30d868181303763953ddd1.exe
-
Size
192KB
-
MD5
f7221f41cd30d868181303763953ddd1
-
SHA1
a03e26c1014b3a204f39f11ac597aa30177be835
-
SHA256
ef75e4193acf86589cfcf6b49d61e88073fd65ca866ed4197da7c5e4b22bac6e
-
SHA512
15285fb21831360150fdff65d431d13cf9049e5c5014940761c88da60966c0676490d22543340cfdd26cbe6b28143e815a7c80d4c51f51d3d1eb9e6f8ed547ca
-
SSDEEP
3072:uFM3Ie8nXQx8Z5FYZTD6vpgPTXPnT/VDuiai7XH5H52c:O3eMXE8Z5OZDepgPTPYEz
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral1/memory/1212-55-0x00000000003A0000-0x00000000003A9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f7221f41cd30d868181303763953ddd1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f7221f41cd30d868181303763953ddd1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI f7221f41cd30d868181303763953ddd1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 f7221f41cd30d868181303763953ddd1.exe 1212 f7221f41cd30d868181303763953ddd1.exe 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found 1240 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1240 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1212 f7221f41cd30d868181303763953ddd1.exe