Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/12/2024, 22:20
General
-
Target
4da6d9d71366ca50188ec5de260cb24fad2d99cbeb42fc4f24408866fe998578.exe
-
Size
218KB
-
MD5
3346ce2fb826b7e3734f41794fcd7506
-
SHA1
c73f7a33f859907d1731d1b8b1c42623ad4912b5
-
SHA256
4da6d9d71366ca50188ec5de260cb24fad2d99cbeb42fc4f24408866fe998578
-
SHA512
2b7454dd693e6da65f761da146ab1758db759c6138cc799cb611963865033904e2424f55f826597d9e23661248af14870e84198e280ebd4a4ac7b0c55ae5dd66
-
SSDEEP
3072:Wvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:I1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da6d9d71366ca50188ec5de260cb24fad2d99cbeb42fc4f24408866fe998578.exe"C:\Users\Admin\AppData\Local\Temp\4da6d9d71366ca50188ec5de260cb24fad2d99cbeb42fc4f24408866fe998578.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c64b4a48a945f3d2e3f944de1f7daee5
SHA12d1329c5498ea70bc226bc347e5b13d6f47473e1
SHA2565ab5500e36388a2794d4812306286a6b376bffa0a1e5cfd569f86a051a943c01
SHA512dd3d2f9e21098da1e10c630996df269da7673c78b9ca81f427753af4e3ab7635d4027321571900da7252ffb487835619aeea5514ace28238fa8eb5b11265aa5a
-
Filesize
42KB
MD5db6b594fc3c77fd8429e7762eb26ce2a
SHA151b243bba83c1369533524434cc65651c42240fd
SHA256934c99e6c7371132c4265d307a57978763b8598a48d8cbd2aeb58b98d54a5af4
SHA51284c07a25b340c21d867018670fc44d42780bdd3fce84c107651f4f3627b381ac34bf0b839cfbe0b143678d437556f04a9576efd92d795f4156cc3bc9543ca98a
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
24KB
MD5cd5eb120281c745638da632ee2f874aa
SHA1644ce9d5784f454a2684880509a7a916f9d515a5
SHA256804d3187dd035b80286429964313172c615289e08a97d79d92285fa2f671e677
SHA512752e508de09100379e4ae7f01b180d357c9309ae9b3fc0a2e789a1aa46b94d2499d812cde473cd58a52e81e09d4eb40a9b377a639be479a9362012187473ae0a
-
Filesize
1KB
MD5395718599abc15349a376c18f3ecb95b
SHA138f01cd4f51b5ca3722234fe2ecf1a956486c1b1
SHA2564e9795798337fefc70ea267b4df9ce9b8048080d65804a9883b2a907894190eb
SHA51210b2a732b1918d5cf1a5442c79b84410bb765b6366560bf2c6fe1d38353a3969971a0b0c6c8fe97785819b55806d9788685bc7da7f1ce08f124d7640f2f4dfa8
-
Filesize
218KB
MD5940503f1fab29de43e52c80f78f566ab
SHA1daf2afd6ed03ac70226bbe104875df6e0fc6ae93
SHA256767cd93a28fc18de7c4ea537ce672eb64db2357b2459559cd6b4f129b59d3d38
SHA51239b43062c11d5b2423f90064c48d813a2db915506163c5f5f4950c60892de9cee334c1787644247cb20ce7d6c30a3f97f3977218896120338357efffe089de86
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB