Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

7zSCD97F9B...72.exe

windows7-x64

7zSCD97F9B...72.exe

windows10-2004-x64

7zSCD97F9B...28.exe

windows7-x64

7zSCD97F9B...28.exe

windows10-2004-x64

7zSCD97F9B...82.exe

windows7-x64

7zSCD97F9B...82.exe

windows10-2004-x64

7zSCD97F9B...7c.exe

windows7-x64

3

7zSCD97F9B...7c.exe

windows10-2004-x64

7

7zSCD97F9B...08.exe

windows7-x64

7

7zSCD97F9B...08.exe

windows10-2004-x64

7

7zSCD97F9B...5c.exe

windows7-x64

6

7zSCD97F9B...5c.exe

windows10-2004-x64

3

7zSCD97F9B...51.exe

windows7-x64

10

7zSCD97F9B...51.exe

windows10-2004-x64

10

7zSCD97F9B...09.exe

windows7-x64

1

7zSCD97F9B...09.exe

windows10-2004-x64

1

7zSCD97F9B...cd.exe

windows7-x64

6

7zSCD97F9B...cd.exe

windows10-2004-x64

6

7zSCD97F9B...9d.exe

windows7-x64

3

7zSCD97F9B...9d.exe

windows10-2004-x64

3

7zSCD97F9B...69.exe

windows7-x64

8

7zSCD97F9B...69.exe

windows10-2004-x64

8

7zSCD97F9B...5c.exe

windows7-x64

6

7zSCD97F9B...5c.exe

windows10-2004-x64

6

7zSCD97F9B...57.exe

windows7-x64

10

7zSCD97F9B...57.exe

windows10-2004-x64

10

7zSCD97F9B...00.exe

windows7-x64

3

7zSCD97F9B...00.exe

windows10-2004-x64

3

7zSCD97F9B...61.exe

windows7-x64

9

7zSCD97F9B...61.exe

windows10-2004-x64

9

7zSCD97F9B...rl.dll

windows7-x64

3

7zSCD97F9B...rl.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 13:36 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7zSCD97F9B7/61cf42ddca121_Fri1754a29da57.exe

  • Size

    339KB

  • MD5

    c6ba95e6a2570df9355492eedcba2692

  • SHA1

    cabb84ac43c787653803d539c4c11e98f0216977

  • SHA256

    d1ce9967a983bf8a13464a30145ea9acda0810f9fad52990e96e6d6fda6c3299

  • SHA512

    6c3874e0f033f00ce9e9451abc6909d88f4e629790a6dba325f4568e29b3d3e1c121c357367833503699f065d5d9d7e064853ef6f4bdde0ef8290979daf26f3f

  • SSDEEP

    6144:f7ag7wGLhJvadhZIV8urx/Ybt+34cRAOaHkIehGoE:f7p7wGfydhZIV8uF/Ybt+3sOaHEE

Score
10/10
smokeloaderpub5backdoordiscoverytrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub5

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Smokeloader family
    smokeloader
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7zSCD97F9B7\61cf42ddca121_Fri1754a29da57.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCD97F9B7\61cf42ddca121_Fri1754a29da57.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    PID:2248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 352
      2⤵
      • Program crash
      PID:1504
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2248 -ip 2248
    1⤵
      PID:3664

    Network

    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
      Response
      81.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      0.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      92.12.20.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      92.12.20.2.in-addr.arpa
      IN PTR
      Response
      92.12.20.2.in-addr.arpa
      IN PTR
      a2-20-12-92deploystaticakamaitechnologiescom
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    No results found
    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      81.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      81.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      0.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      0.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      92.12.20.2.in-addr.arpa
      dns
      69 B
       131 B
       1
      1

      DNS Request

      92.12.20.2.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2248-1-0x0000000000800000-0x0000000000900000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2248-2-0x00000000001D0000-0x00000000001D9000-memory.dmp

      Filesize

      36KB

      Download

    • memory/2248-3-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/2248-6-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

      Download

    • memory/2248-5-0x00000000001D0000-0x00000000001D9000-memory.dmp

      Filesize

      36KB

      Download

    • memory/2248-4-0x0000000000400000-0x0000000000782000-memory.dmp

      Filesize

      3.5MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.