Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/12/2024, 10:26
General
-
Target
3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe
-
Size
208KB
-
MD5
070e9c8cb132754c3ee88ce0ba149e1a
-
SHA1
ba97e75607f569a1454664bead3268946941d9b0
-
SHA256
3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72
-
SHA512
0d93de4a170b05e17efe8758122e700a130ebd3c915474f82d40cd1265a96e06af18985cb98cb6fffcdaa79d11dfe799a997b128d5079c648ace52c5a2977ae8
-
SSDEEP
6144:ka1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:kbapK0JCmRcU9vVokfj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe"C:\Users\Admin\AppData\Local\Temp\3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5651f005fc9928dddbe7855842328eb66
SHA1c57bb67e042fcc01e29b75274ead1bcf8d1f0349
SHA25685d042ef0e089b59dd23cdba3ebf83374da5878436001366a93bc4bc5725178a
SHA512c9a2538206b4b7c99fd68d4df5bf59a762eeded2b232857cf10b70719878e6eaea33ac57e7a3bb8e7fa5f3780834d688367abfbdda225a4d312463271be1bed9
-
Filesize
1KB
MD5756ab6f03e220bca39ce318ac97b30f2
SHA16bcc2d06917d7121a6772a12be5386a172f3bd07
SHA2564a762753dd489f2d1256638ab1a15bab906ace83476d1b09376f920ad5293c6a
SHA5126427aa52d91092d51faca211f0f0dd2d32898a65b90bf9709dec728e6b503ae00f669621b31cbaf981bb034e9a5ea89ae51183b85777a09859219aae95ff53f8
-
Filesize
42KB
MD553a9087c02e05c59caba795afb6bf8ff
SHA12aa548b572efb4f0b53aecca371f7679f729f0c1
SHA25679ea66c2ef14bb21c027a6b0998990c6ce4a66a42be980634d8234d767b36d61
SHA5122c8e9128817599be7d836f0e4712119fe168e96513cca0e59146db6a2b4764beace58ff0f960fe792f25bf0a14e74e450103c8275b969d0b816b8e07e882d73a
-
Filesize
1KB
MD505deaed644e2bb65e7e90b02ff37ff1b
SHA14e2a610b6c3b2be67ec4bd0da0842340b8943776
SHA2560b6a6523337eb160edd849e12d4c7a6e6bb7244e5aa062e6088e574bddf6c2eb
SHA51222109d297efccce688196a8c1a1ff4b2960304ec58286ffb06658a76737af6327cb4ed7db67c27693c0e9d39df10c0d5efca3603df063872e18866f9469119a5
-
Filesize
208KB
MD58619fa5bff7872718dfaddcd89e4e437
SHA1dd52fa6752595aac78f1fe3f29869c1c37d34938
SHA2565712ec7bbd421f2aed970862650b7aeb749cfd3ab666b1e6c2eb5dace6bdaafc
SHA51259728c2c7d4880aec7e8e4405256a55d32254cf9c5e2ac206349c195a55b18cac969c2ea7f0e4c86da8310fb3d8190a373fd59f75323166dac874c806f7b647b
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB