Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
01/08/2023, 00:00
Behavioral task
behavioral1
Sample
0x0009000000016592-111.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0x0009000000016592-111.exe
Resource
win10v2004-20230703-en
General
-
Target
0x0009000000016592-111.exe
-
Size
37KB
-
MD5
8692ca9311f4f80ffe280831434efdf6
-
SHA1
52ec2c8171239b64462cc175093e2efcee15d20a
-
SHA256
5619fc9f106cb00ca2a488f7219345fa042fcb925fd370a469263ce97d9ea301
-
SHA512
64ebd22890cab3542239e64ad37b68ad6d83f6d76bcef685ae6f2f1f331537b88c98953cc01bb0bdc22f781cd8b732f77ef904267dee1af7183d4ac4dfdf5d96
-
SSDEEP
384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
pid Process 1196 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2108 0x0009000000016592-111.exe 2108 0x0009000000016592-111.exe 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found 1196 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1196 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2108 0x0009000000016592-111.exe