Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/12/2024, 00:21
General
-
Target
9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6.exe
-
Size
355KB
-
MD5
9980660679e50998dcf638657fd81080
-
SHA1
c66123fe98f1322b66a7d431c3805e15f3aabea5
-
SHA256
9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6
-
SHA512
76bb728072b4f99bea77905466c53406774b11fee7e6ad7cff3af5145e10a33a67cff9124d53af5e50caea75c04a4be20a90a56a8ae75054d4728354cd18e8e2
-
SSDEEP
6144:L3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:omWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6.exe"C:\Users\Admin\AppData\Local\Temp\9422cd3100f41a0dddd77b46384044f63cbb766e460ce215c73b1b9a5b9e8cf6.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5eb5bac7b748676d63272373342cd56dd
SHA1d714f213e53124a279b25bdb9fb42f61ac8ef423
SHA2565bbd729966c3a848dd7a65e3270856985c96783425a4b642288dd6f1cc8350cc
SHA512aad03699669bd4132b24ca1d6152f9517086ee4c041779c1ec7a5690c5d5cb04e8567979f97a1d3fd883604e0dfa6e32253f2a9b15bccdf81ebefe0ff6495878
-
Filesize
42KB
MD5f9ce9c8b1c7c01afdcb14883f733a164
SHA1621009950fc3ac6e13e3f023c6b88b0a17dd8fe9
SHA256440c247e6b34841628db4163bf8dd52cf4d3c42ff37ad06fe90d9659bc6f4938
SHA5120a8e21aa2ccb4674fb8ef533d35730363dd3c3c3dac912482e22b246fdc7668e3309e726c19020b783bdd3753ea5bbb9a050241c8c922a226db5bb2a5a3c7be1
-
Filesize
355KB
MD5988a4eb004fbec0a42232cd338a24ec1
SHA1a72b1bfce205fca366692e84b2c280194cf10b43
SHA2568a9929c59fec62f12bdf3c2f5d4ceb17f0d30afd4eb8c863bbd2b769f596b580
SHA512b61ed8f6ba79baa2d19f1afb80b0c7b3cb120bcfaf2ce440617b655e417f4c3fc3d35c38f78b4ae03e4c90fba77e691f32f9f0ed41f80498a143b2a2f2b5f155
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB