Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
06/12/2024, 21:14
General
-
Target
3123d52af1f116f662148a7758268d87d941b76525ea654b184df1096dac1254.exe
-
Size
375KB
-
MD5
6a28ba661e76221e6c4b091d179ff64f
-
SHA1
26d73cbc48c9b11a553569235f11f0c24763ded6
-
SHA256
3123d52af1f116f662148a7758268d87d941b76525ea654b184df1096dac1254
-
SHA512
0f76aa15ca688a85fe363b2de068f0ea292aac635f8c45250ce1756671d1d6e45f37de8964ff315426d72369b5011429ab53c1f643cf719c94c8d7d91d199146
-
SSDEEP
6144:u3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:JmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3123d52af1f116f662148a7758268d87d941b76525ea654b184df1096dac1254.exe"C:\Users\Admin\AppData\Local\Temp\3123d52af1f116f662148a7758268d87d941b76525ea654b184df1096dac1254.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c051dbac677c535fd4baf769c07b3dec
SHA1991fa16d664862a5a517abe5a19285ba278a4e0c
SHA2569f172256d48ff4aa992e32e472c591d2fda3c77dc364b85c2fa3bfe012576480
SHA512eb5f997d0d1a0d3d8aa34a1c9e5140627c219825908330f06edeb49543ad5da5d5add760338946706301ce16e5d178de9e63ed946bec2ad9fbc78bfa019c3a7f
-
Filesize
375KB
MD5209fdf861e8e634748257a62a817ac8d
SHA15f3c8a53b5acbd2dca1f791db63a7f97cba029c7
SHA25692e43633821b0707c91bdeca859c0f5df60b091ede064aef0feabfb0579a0397
SHA512fc7f1ed7f25352fca826c68d77427a02dc6586bf61e2b0b2ffbb1094ce5a0362ab2f03831d52167abdc556ab437bd5da298af097c2a95b238d57b8f2c598e123
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB