Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
04/12/2024, 07:33
General
-
Target
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe
-
Size
208KB
-
MD5
1ae630c9073650cfadaf1ce8a2500ff1
-
SHA1
f6719008bec7a1f9c52557f3ca6cf5301dd0ae35
-
SHA256
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77
-
SHA512
07ed34719dc16f95a13a928cf03fcecc8f375328caf012e4e399a1ca51eb0ec4de01c24cf8cd5c637afa9778b3c4534632a3e39c2e95161a792304bb3043e72b
-
SSDEEP
6144:BOYX27lPBA3YDMw4lj6idlMlwl7/79C87A:BwBAy0rlMI5i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5033b3f1ed1af8d8bcd1cf9f05decd9e8
SHA1efb81663d6132d7387fab04b1501dedb5b84b0ca
SHA2561d5f75e36dcaff065b278c8086f194ee0a5c8474ac7f0713ac896cfdedd1082e
SHA51255f180f264df8ad494149d05eaa2772bdbc562b42e62b43a742d5961e4546985c3adf302ab51cbd25662570d5077e7f76cff85356972efeb413c9838492cef3a
-
Filesize
1KB
MD50bbd21f09b69ac2ffe81618539084af4
SHA1aa9a60701da75eec9dada423a5b0ed7c244bf1f5
SHA256e569e5de7cc0f214e775ba78eb3179a0e0d865c0f46b74f65ba24d89ee38dc14
SHA5124819973aa6456db5fca77e0f98e231877999836ce02897a5001e00604910f19f9b1b7a0fed8fae24db89af726162a63624cb4e9cc71ab7a9edf1304c4ee6ef7e
-
Filesize
1KB
MD5a217d3d847f522f3aaaeb64dda8ebc54
SHA1ace178db793e391d088a816e691b181699d59fbf
SHA256979ad732ba0bf90dea6b687b63dc1bf27fcff50ccb243c995217b33a4cff9020
SHA512d8c02fd1cfd5f29242946d7dbfa85ea24be5d8419f9e07909aa3635f8578c96be22f3f5aff80ca38aaec32dcc3e498738c67653e1b9710d549de1ba693c746bb
-
Filesize
1KB
MD52e14aae764ccb9623a57c11f6c5bf42e
SHA112f2536cd46f070146f30ef58972cff5858b423b
SHA256856daffe2b135881e98be207c67c16f1ac3119a44aa7abec4126982c4be55971
SHA512f01964adb1099c77e128563329d2704f12d5998df4feb4d1f1e008b1b5cc2b4a2f43ae4c4579fbc0a4705adeb2b65c4a501d769917ba232c164e07a59c24c2da
-
Filesize
208KB
MD53f47f70c9951975523c30f099aba3da8
SHA15a822902eb1b2216f736dba890efb20b5afa3e39
SHA2560a22c7c2e2ba236b9cec4e855aceffda47bdd27ce0b7d3ae2b7f0244b23d3cff
SHA512b54a6e12a1d3e337eb3d3a1aa4fba5954c1dbf90b6c5d4a21b104e839bf7dae52a4c9ec4a9b0394b29e8533e09880a77512f74303ede52265794286ca9613f86
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB