Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06/12/2024, 02:03
General
-
Target
c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe
-
Size
217KB
-
MD5
0ec4e7beb77023e14bd5a4c00903efc7
-
SHA1
3d7ccc8483e0d4f537d7f7e40c00d11fdce6aa3b
-
SHA256
c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4
-
SHA512
3975d018a9f616bac76b36659b79e26d3477a2dac5f4e1294e2992f6a5899f5c26b5dfeffe4bc9c60e2af7e40bb4c698f36237a8a120b5bf9d02e9fa85629cea
-
SSDEEP
6144:VrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:FsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe"C:\Users\Admin\AppData\Local\Temp\c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56116f817e052f795e725aea1d5a4c6df
SHA1ad7b7ea04c96af2adf602cb2a0cd6566fda8bc02
SHA2563d4ce34e35dd5c329a982421a5744c44f451728970cc20f90bbbad6fa2c1e792
SHA512bd023f251b12c7766978230ea194d19b0e7a70b80ff68e01e07307ce47eae04e2772f19a26c9e313b4ead1eaa956bd4545275bd773b7ead9a5ef376560fbc24b
-
Filesize
217KB
MD5c03d57884b72007481ba7ab9e3fe34ba
SHA1c870cda477377d3e328bf418e833cecb2069b832
SHA2568269895c68b62684bb84ee632b6140f358f36c9b0fc8a5f970d390d85cabb353
SHA51236d33033241e6d6a0e6a4e5978bdbe8c355ec0cbd4aea2ce4e8e1ddae012f13a0123f12c944afcf0303745815cb792fdfbbee16ab22736d2e98898cc133ce647
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB