Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11/12/2024, 07:07
General
-
Target
ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200.exe
-
Size
218KB
-
MD5
3a1f35d8a236091c3c538363386a5866
-
SHA1
2495a6178448a911aaeb7a3b1102e0fce9b563b5
-
SHA256
ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200
-
SHA512
b0ec350d256cffeefe2a13bb3aa24700900d7172bef67371fc847249a89fd0a49a9f12bcd9be3cb5ea40428653c27ddde9df583b754f68fffe34cf8cf68346e3
-
SSDEEP
6144:xEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICC:xEGDdQNHEwWlMxYG/wIL
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200.exe"C:\Users\Admin\AppData\Local\Temp\ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53377819ed00fda0c51e57eac0cb201d8
SHA10daf947b21f2dbd7ad698f0f8ed50c009defab21
SHA25620ba1838e58842bac71cd11949ff757b79452a8a91f1bf1dfdff3d6bd559ea8c
SHA5129d7a03fdc532711bf4e10fc58f045ee0d0a32089c9688dca842192b791970b549151a4e83807137b3fb8e8e8beb0829d8fec5a306dfffe091db9fdd383147850
-
Filesize
42KB
MD5afd6fccf923b989c3734a98beb266827
SHA1c459e9032058419ee28285afbd7d1fcd1924ab5b
SHA256fdd83b4fdfe230a983eb104ccaeae550518af6fd4d7fc20fe114f669edacfd7f
SHA512cabe2b082daa3f1dd19401f92d48bbbcfb70482a5da26cdd0486fa1f89d0b848de4e05423d5cce63965c16befcbd3cb51b4c25405eb759a3c09975490912b539
-
Filesize
42KB
MD5ecbf9c61929a415346d71a72abea0cb8
SHA17925d2fafb7b321c7a16cec9e7b6c66854a209b6
SHA256b054bc4f357315f981b000b7724856981643642afa8caaf53c0713b976ada8b9
SHA5125a1b1c9a4e862789f03d118b231fcecb4d8a19b64308e35a326ed4da56e07e57aa4cd0520138f2b7249e2d7b78d09dcf9eac99e40fab17a8ece0000dfd66b793
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5e6e57d3a7673c6df7cb2e0a827be1d25
SHA1389c97b1e2bec7cb558c386ada016d7912963545
SHA25602b46a3635f09a308a959046bf03dfecc0acf619b3a3f6a51382171607087623
SHA512690c3331d9ba7a223859c0a3cb17fd3ab9ce44dc853c92689097f56a471937f26b376380f1452c344bcd4cd8f63daf50f757aec8d72ae040524b0658978265d9
-
Filesize
218KB
MD59765416c757cc9d0181872c59334ee3d
SHA1b1232c1bc1a62d23c2650d20dc1b2d4504f5bf63
SHA256f46339f5e6febb8d3c627e197f126106179e5ab44dc36a3bb55324350c1dceae
SHA512e4a9260fa9df0706577704d18d3c71038e6907effb9f76012c24bedd807aff223df9a30753364621e24dc7adce7d5383ecd368e7fd356961d4e077973dc8312a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB