Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
21a3403e49ae025b38441ee648e8eebf5b99b7c24226b968f2b38a4ce66ed431
-
Size
219KB
-
Sample
240108-ffaqwscda6
-
MD5
71c0797d060ae8a45196a9336fbf7b5d
-
SHA1
a2838790fa259240e53207be47535d0f89d15f40
-
SHA256
21a3403e49ae025b38441ee648e8eebf5b99b7c24226b968f2b38a4ce66ed431
-
SHA512
2c2ae9c6510408b17a77e3ac1623a550784d2002fcaea4bf75372aeabb06a430cbe7f5543fd9631c92a545a0817f007fb65d192d75c35239c3bbb7a906fb48d9
-
SSDEEP
3072:s9L3vACvLJiX7ezDwPh0jb4rVyYI08+Yi1DrRlWwgvXF/LwHO1/D:s9L3Xv5cPhSoVyYI+KwgdDwHa
Static task
static1
Behavioral task
behavioral1
Sample
21a3403e49ae025b38441ee648e8eebf5b99b7c24226b968f2b38a4ce66ed431.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21a3403e49ae025b38441ee648e8eebf5b99b7c24226b968f2b38a4ce66ed431.exe
Resource
win10-20231220-en
Malware Config
Extracted
smokeloader
pub1
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Targets
-
-
Target
21a3403e49ae025b38441ee648e8eebf5b99b7c24226b968f2b38a4ce66ed431
-
Size
219KB
-
MD5
71c0797d060ae8a45196a9336fbf7b5d
-
SHA1
a2838790fa259240e53207be47535d0f89d15f40
-
SHA256
21a3403e49ae025b38441ee648e8eebf5b99b7c24226b968f2b38a4ce66ed431
-
SHA512
2c2ae9c6510408b17a77e3ac1623a550784d2002fcaea4bf75372aeabb06a430cbe7f5543fd9631c92a545a0817f007fb65d192d75c35239c3bbb7a906fb48d9
-
SSDEEP
3072:s9L3vACvLJiX7ezDwPh0jb4rVyYI08+Yi1DrRlWwgvXF/LwHO1/D:s9L3Xv5cPhSoVyYI+KwgdDwHa
-
Modifies firewall policy service
-
Sets file execution options in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1