Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/12/2024, 20:02
General
-
Target
04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b.exe
-
Size
217KB
-
MD5
2ba798fb98142f5d6467eed2b70ac5d1
-
SHA1
07e4c15044596f011d785fa0d2c08a0b365a0402
-
SHA256
04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b
-
SHA512
69a42725dae453e334ea6a33918a012244445e93aaddcb884df16088a1e6f3fe3247ac5ed2840a6a406a3dcf1eee52304e82b80742a7f469e2f0916ac63fbba9
-
SSDEEP
6144:qrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:wsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b.exe"C:\Users\Admin\AppData\Local\Temp\04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53a22b2c4f1a6689d660768c6c02b9f2c
SHA143d71b00a33e342d857479ad157a52cf710c8ff0
SHA256f5f600e493fa911483bf48409f96d280a88a5e92c46cc45d748786bc99aa88aa
SHA512b4226dae35fa882bbaf5508f6052790a2d04dd8e29b1a632b39bb04bd082fc91818a8c04adfd6997e4f94f672d4ec34b567231bb6b6fc324d4a937b5838a2e14
-
Filesize
42KB
MD5489cdac7f3eeb3707958cc7fd948e47d
SHA1565089f4235e293fcffa54633cfe5139251e7f25
SHA256ee3b25075beedb5fe7adf9f23d4b682043a37794e44c74f41cc939a6f8b47134
SHA512cc1dfe16ec7eb9cdcc65475b722e40ff280efa2f10f74c393dc9ac959d9a1f24b260fc3cf4407289e94b13b0e1a6f7bd7159f7918b72819372cb37dfb7aa5332
-
Filesize
217KB
MD5987d196e8e60be43741bd42bcd6dfb58
SHA1d626c03eae2be0e1644c68b88a3e7bc86bed1814
SHA2563d9b7dac867e2f221334992421fd1d666528027736eae84f37b49bd1143b3494
SHA5120d15b5f8af1b335186bcd2a59abd001ec3748898118669cbdd957b70a5264cc7451cb818334f80783425f613d04928295bbeaf8bc6cb98843a069d0f732fee1d
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB