Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 17:54

General

  • Target

    SmokeySpoofer-main/SmokeySpoofer/Main.cs

  • Size

    25KB

  • MD5

    e18b9d4844a0e2526a427720115ee569

  • SHA1

    18d553d3ecfd6ff3451f166473f8f7121468882f

  • SHA256

    84dd3f1a32e611270322f5323e3d853145b78bbb463dbacec6777e65a2cea66c

  • SHA512

    90ace917d3bf9ed775ad04dabe9bac4a2b798c4fb21920a6330ae8cabe9ac14869a93d7f831dd4bb965beac3adc2814cc444ca8b659a047db3ad93edb3e3db40

  • SSDEEP

    768:6+W636xBoT2pbdzwZefxDtYDmZApuvruMh5i6Yj:6+W636xBoT2pbdzwZefxDtYDmZApuvrw

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SmokeySpoofer-main\SmokeySpoofer\Main.cs
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SmokeySpoofer-main\SmokeySpoofer\Main.cs"
      2⤵
      • Suspicious behavior: CmdExeWriteProcessMemorySpam
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    f87b02d27d71408a7f4de2d28d654aa6

    SHA1

    d0f22cf7f28ceae8e44f4996282fb84acd6f19c0

    SHA256

    20794a5531b44f454d756f8c7ab4f5f9c57a15c2b8043a4c962cdac6a7d9ede6

    SHA512

    d4852bc4cc7437bd9bb7dbdc0b1cbfcceef1917bbd2d91be2cd2bac4f5058da3ac30c827f8dcc6419531cf335d3038cb8b825c2b2e08f700602ce1895beff612