Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
06/12/2024, 08:33
General
-
Target
e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe
-
Size
355KB
-
MD5
d5ad61b8ab1703ab66bb8452c961739f
-
SHA1
c8e516fcce38bd7390ab9c4b8c424c9a6ce99321
-
SHA256
e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5
-
SHA512
aca99fe4de04220de4495921608d5e2832060175c7c17c688e4f93f8f1f4e07dd9b7564545d2a195a9650b3db774de4a624e6c6ea0fac8ecb9b069f601c59286
-
SSDEEP
6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eiy:3mWhND9yJz+b1FcMLmp2ATTSsdy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe"C:\Users\Admin\AppData\Local\Temp\e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d4a27028ad5173040f31e8d40867ef5d
SHA17e5ccebb582e4a13c3d5a41dff06a313c0ae1e8c
SHA256a4f4d19dda8a01bd443b813ebe6d8d2953329f24533484d40c9c83754de2dff2
SHA5126f73a9f2333f3e44cbacd5b74e06dddbcb2639d524977799b388865b4197976a55a17e95fa0679ab6a488bd46c0469e827215986f0ac51967e8440218ddfbf5d
-
Filesize
355KB
MD5fa647c4437eb977702bb22ac16bfdddf
SHA1a7ade62ec77639615718b2dcc0cbc8ab9beb434a
SHA2560c68671595e4d6099f76e43b4d9dcb1af9ae6856f52da3cd36f8849481bb676c
SHA512132bb68f2881f91f2936008cd7d6e3455c09b343ec9cc12da19c45f55f12517e07dc794f181994daf2dc6ee0e4840ff716dd7702e39bbdff8cfa8a2f8ddf8c3f
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB