Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26/12/2023, 13:28
General
-
Target
72787c0133ebe280a7d16f6db8000bcd.exe
-
Size
326KB
-
MD5
72787c0133ebe280a7d16f6db8000bcd
-
SHA1
b287f8d7f22ded27444ae999e65a599cca8cc60a
-
SHA256
01e062f17f17f54100c3d6849477017acdd7bd57f751a7eb18484c77474d5a6a
-
SHA512
8e2fd5d50d0f4579a5b7721d5c1fdc6bef1582822a723f293cf0b982eee588bf9d933499c5c16941474a4e3928c42d2305984652aa9542ac31ebcea4dcd9c596
-
SSDEEP
6144:FXURnqgV/GvULWy9BtdNVJjq3MGMXmSUexV:FonTTWy9BFVJLmUx
Malware Config
Extracted
smokeloader
0002
Extracted
smokeloader
2020
https://cinems.club/search.php
https://clothes.surf/search.php
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72787c0133ebe280a7d16f6db8000bcd.exe"C:\Users\Admin\AppData\Local\Temp\72787c0133ebe280a7d16f6db8000bcd.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
84KB