Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17/05/2023, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
monitor.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
monitor.exe
Resource
win10v2004-20230220-en
General
-
Target
monitor.exe
-
Size
233KB
-
MD5
331b64dfe60413c44f7de1dbfefb59e9
-
SHA1
8837d8aba27fe01b88ba92e382a56f9c6a18aee4
-
SHA256
b3d197b791547c7433f7f5a7b875ffbb5dafb9ffe1f5e114a1b6836161922c4f
-
SHA512
06821a7a4ffa9fc2c2d51509cc6626c864a5e2cddc3e0aa886982979baadef9420ba8f778a09ce6cbdcc16d843eecd9d4443992f82c73d2589fa3ba699a36afc
-
SSDEEP
3072:7pN5DpaLGDemZDmAF6ykzRO/YfrESKLt8GYJp15Ksrf2or:5pHmE6Zjr5u6G45rzDr
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI monitor.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI monitor.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI monitor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 monitor.exe 1948 monitor.exe 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found 1184 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1184 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1948 monitor.exe