Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 08:41
Behavioral task
behavioral1
Sample
4616-267-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4616-267-0x0000000000400000-0x0000000000409000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
4616-267-0x0000000000400000-0x0000000000409000-memory.exe
-
Size
36KB
-
MD5
d3f56e4f395cfd446ec0e4838088a599
-
SHA1
58a9d792144959ab71463a555d1c4e8dd1613c1d
-
SHA256
02c5b7b22633da0e5b2c8b6da39e41458d7d9be55e95be3a6346433e8eac9822
-
SHA512
93466cff10feca6b9567c9e378187a97ed8a92f0de2106a38846909073f5e9ccaab01a60d46206cb5bb506a556ee7d440b97d0728125af8e1ae545b7b05abc23
-
SSDEEP
768:OkUqYDNbIoKpDd1KM02kQhx4hOtFceWzYqvz0bOS:zLi1LKtd1PBkQD4UtFceWnz
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2276 1884 WerFault.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4616-267-0x0000000000400000-0x0000000000409000-memory.exe"C:\Users\Admin\AppData\Local\Temp\4616-267-0x0000000000400000-0x0000000000409000-memory.exe"1⤵PID:1884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 2242⤵
- Program crash
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1884 -ip 18841⤵PID:3264