Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/12/2024, 11:25
General
-
Target
b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b.exe
-
Size
218KB
-
MD5
aff18d8ea3b6d9a6c3de24f50d758d97
-
SHA1
679a93807137bced60955decede1cb3f99212a82
-
SHA256
b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b
-
SHA512
7cfff5537a3eeafb559bb6b5c4d9cc591ea8a9b2bd35b0212f17884e19b05c6515e1f14fe7dd894647513c4532ae352edaa64cdcbbc1c2cb2a6637657e4b69ea
-
SSDEEP
3072:Dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:71SyAJp6rjn1gOObn4b6h9R
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b.exe"C:\Users\Admin\AppData\Local\Temp\b4224ab6cd9da7ad95d37546044349d7eec73b4877c8003d43ac41f16936495b.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD556f078b0b04962f2de3de631299943ec
SHA1be18b1898aa5bee7e87d750446a39fd3755115ef
SHA2564417c05e85d15fbb18098a8362c1f978640b8b67aeddd89043ba87b5f6a0d116
SHA5126117a47c83a20e41d4cdaba01fafd7b77fdf38a21939088e366ab58d4e85179af99eaeaf3edcaae1c7be8307b51d44aba2fd24167a567f24df06f6053ac584d0
-
Filesize
99KB
MD5c6a344cccc0e5ce2cfdd30e6358bd2a7
SHA17f7d0963b318d9c392e5fe8061b811ed2d1dc848
SHA2567a61987f812a0f4fdf4ae060b3099fc9017c51b1440aff3913dd0a421bdc0d38
SHA51228767f2d2079d2515cddad181b695226fdd54abd414783ddff5e882c3625e001d5fe4f3b05d5b3b787069feef4ccc6107cf8f9cf0740628e3a60a55eae9c41ea
-
Filesize
99KB
MD59a2b100e2a702e798f8ca838c59c7647
SHA157c78f972dbdd081a0393705e06bdbc5f3912a1e
SHA256bc8b6c8069e5981b9421f2d167a0e555318872c8b44d6039163038f80e279eb0
SHA512f27777dba9e8caf179393a6a33b32f5ee3e8f19d25a65aa99f8d4d09ca895800a4ceb0664f921763200a3c07a7b6b08541a6e140805121ad5360fad4834c46e6
-
Filesize
1KB
MD57442f50751ed64b6adec63d37c803580
SHA18ad42bfc3d5ed97c3475d647f062e493897c499a
SHA256fee50c43d8a8e6aa16e30b0a959116a949e0efc34c4d68413467e346867ec559
SHA5122075ad3db7bce8547f83b5b92d2b7d71a5562931f2a0e255f477f05022913fa6836f143d839a6f6828f98a9eb6b70c4ebd409300070567275b560980ff8d8781
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD578f267610353f51453b4f88b4c30bbee
SHA176e9b130147cc083c1840ca6bcb4dbba4ab9db47
SHA2562ee10dcf8842f1f2708472f0b0a31cd9beafbb5fcdb502236f3bc2a1fd6c34d5
SHA512454b7d8a2dc9dc62c8123c3c1d6233ab4473b99266a9227210267f8ba306c83a510115ca22135b0234cfb22716e2d870fa132669faa929671d1e13312366b409
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB