Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
04/12/2024, 20:16
General
-
Target
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe
-
Size
217KB
-
MD5
b094ceff6d937a4283d50d0dc406d203
-
SHA1
f4edf55840be139785500f72f23310220d8ebf1d
-
SHA256
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936
-
SHA512
09e158b2939dbfdc6ef03c2d0612ac2a4ae9cdaa3c9171379b306a58fc6bf5388f1f9e888b7658a6bc2018aaa68000a9e851dbcc08b67c4283932331dc69c560
-
SSDEEP
6144:urRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:csTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59732846a2305d310cbfb900114be6a2b
SHA17b6d74b067a5ecf6e2f3fcfc27979942710dba37
SHA256269672723cd996dc276af5b885b7ba5fd42f353bb4444ee05063336ffe11bca4
SHA5125c05aa4afdf939108a5b92dcce92d3105510f152579c3d533f07edf823cacb32dff1aa3da955ce2e0695a9b3d9fd0497c791431ea3099dcbe4dbe0e56c52802a
-
Filesize
481B
MD51520e9d811f9a5c8ad805f25fc2e0068
SHA14bea7ad47f1b22a140a773c6e47df4b66fef966d
SHA256e5324c3874bdbcde4eef014261f1ca15c39b5d5c5e18fe962e94891bdcf9b7e8
SHA512aa165c3fcdf1f4441b079017d5128b3b8ea3ba8dbec4dce85a7e119e455fe4ecf6f680118d816d4d0fdf1820d95151de3eb083e152781cf7355df664a0569c5f
-
Filesize
217KB
MD56fbf37408eb95ad0a39946ac844a9a7c
SHA1de062f212b1ba213e1a6db0419193c6502101fe0
SHA256cc8660b437e331bf459fcda34a8856941df838431b7bc69798205588fcf42807
SHA512ea50b61f07c746c32d1f546df57ca9c6a1678fe57c3ff8415c3e890da4e1bf775945fc68f4d4a917d8145bb9e93d822ff981df430027e032cf96ce652ff787e3
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB