Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11/12/2024, 05:20
General
-
Target
7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634N.exe
-
Size
218KB
-
MD5
ee73f7ed31a1ab3533500b9cffeec860
-
SHA1
c2b70c8c4058cd459e902784ad13d0a5130087d4
-
SHA256
7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634
-
SHA512
05a965b8d30d401d8b8c7ac3a2228de8159d189ce814011d8cecd84291b2d4b4286370ef0281bf8447f2d40759ad73eb6d13d251c51e9d094a2fd6f29edb5827
-
SSDEEP
6144:xEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:xEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634N.exe"C:\Users\Admin\AppData\Local\Temp\7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5662d27bf74598fc154e1a51327733e16
SHA1d1fbe0f303212a4c8a62dab25073cf685a7b8837
SHA2564b5d0910e9ce43436818a4217b86dae3706fcc3a232063af3c8a7d1e8f7ade73
SHA512e757b303ca745c7c430b31be47e7d64d6a901daf9267c1df4bbf8e4eff99d04423a977c1a3c320c3d38014225e8afacc1186b8c36f7833b3495617738298e574
-
Filesize
42KB
MD543b9834f1e990829d9f6dfc064166f77
SHA146b07d410f1bcc98ee425475e6610dc2c23e3e34
SHA256ac5434db4d52c6a16dfa15d22061ce82617c9fde0ce19efefbbab3f1f561e603
SHA512a8047e287ec55daa7e3db861555dbdbc3c61a57fb0cb9513564e67aa4c12bd47b98fde41fa5a245d537b373c3acf0840f314ceb0dfc3e2b40531af34ca649514
-
Filesize
218KB
MD511e03ef9eaa315861425ba66f48bd653
SHA14b4431c5d9c70867495d28ebcf8b7b762c614965
SHA25682d4a917915bd41d88fcca25e0755f49d52404a8c6451d903447d708190c03c6
SHA5125d64633985186a8c130623f187e78ee89f9660ee28e2a4118b6d09943641bcdcca8808c065d3b7e478e2c2dc65da24b4ba86716944c65f82d0d2b4b158f59ed0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
2.8MB