Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 18:36
Static task
static1
Behavioral task
behavioral1
Sample
Transaction_Ref_26082024_jpg.scr
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Transaction_Ref_26082024_jpg.scr
Resource
win10v2004-20240802-en
General
-
Target
Transaction_Ref_26082024_jpg.scr
-
Size
469KB
-
MD5
793a58e683a54d24d3c6bae96df29d65
-
SHA1
09e7bdc6a52fa3290fa7e9ee0471c0d1e445a2ce
-
SHA256
80f14f5249c49d21ea607b34fa793d523e03acda8298b1ab1ae8a3d55428c6ce
-
SHA512
f9d6a7d6bdcdfcc3507c55de2e2273e8681f5e8002cffd543bd664064c7e96c35137323f21a742bb00a6cadfc66e06084ddab3ba68207e97cbfa55fc7ec83e42
-
SSDEEP
12288:QvIGc227fgEH/ZnTzlyi3EV/189JhnuYfW9akuz:Ax27Jf9Txye6CJRGDu
Malware Config
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2372 set thread context of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Transaction_Ref_26082024_jpg.scr -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31 PID 2372 wrote to memory of 2868 2372 Transaction_Ref_26082024_jpg.scr 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Transaction_Ref_26082024_jpg.scr"C:\Users\Admin\AppData\Local\Temp\Transaction_Ref_26082024_jpg.scr" /S1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\Transaction_Ref_26082024_jpg.scr"C:\Users\Admin\AppData\Local\Temp\Transaction_Ref_26082024_jpg.scr"2⤵PID:2868
-