Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/01/2024, 07:31

240126-jcpx7aghd3 10

26/01/2024, 07:25

240126-h81h5aggd5 10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 07:25

General

  • Target

    ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe

  • Size

    344KB

  • MD5

    766801c28e2bba5d4587ee22941b6528

  • SHA1

    b718a320f4482e397719552f098a67b883c88b28

  • SHA256

    4841be428d00d29ab878fda23850d948bc2d12eefb31621c0272e301d95bbc7f

  • SHA512

    8f5cb9f7f71add967a44376f7d013b9342c9fc2d64413e32782354d3fa7959c55a07367bf41e1452296fe9b3b8add120449889195a5954044ccb8279df81eced

  • SSDEEP

    6144:Rg0i18FzH1EdOesCdFGSRacbvJNLW9Y3fXkAF:Op18FzH+dOevRaclNDfUAF

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://kitfishstore.ru/index.php

http://homemademagazine.ru/index.php

rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Deletes itself 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\ДОГОВIР_ПОСТАВКА_11224_Вiд_12_01_2024p.PDF.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1384-4-0x0000000002620000-0x0000000002636000-memory.dmp

    Filesize

    88KB

  • memory/2656-3-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2656-2-0x00000000002A0000-0x00000000002AB000-memory.dmp

    Filesize

    44KB

  • memory/2656-1-0x00000000004D0000-0x00000000005D0000-memory.dmp

    Filesize

    1024KB

  • memory/2656-5-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB