Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/12/2024, 00:52
General
-
Target
71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe
-
Size
208KB
-
MD5
bfba0821b087628fdb86cd1a779f98f0
-
SHA1
ae252e625987c7be3982a768060912bbcd34e695
-
SHA256
71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11c
-
SHA512
9621d508fee45525d07238725b440fd097ec851a7cd2c0e06efd5b50dfd03650a11ed03cda8933015662cdf9a43bbdb2fac7de178c0bb428a375aa2f18ba0aee
-
SSDEEP
6144:LOYX27lPBA3YDMw4lj6idlMlwl7/79C87:LwBAy0rlMI5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe"C:\Users\Admin\AppData\Local\Temp\71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD568afeb10b539a79a67a9bd27b8b7ef11
SHA17400911db6b5d5c79fbd1c958c159b029fe26f38
SHA256255e8e86a3df8010fdd92c9d07e4c9dd8f7f96e00721d88da5338b0c1103fd88
SHA51227df7b1ced179a94cb475f0915ce0760a64faea08aecd0e18ad0654457b0df0407f4791b549911c08c6f64ea6a2dcf3ce720f0c565c6eba9c286388653adeb02
-
Filesize
24KB
MD5da482c2a354959e1394f3b4284d247bf
SHA1ad96f7ab06a23ea75ede9d6bcaad114346f51c79
SHA256363680926db53f069b8ffe30f2d45e6d47a38056262e8a01c8af9ba4b05ecbc6
SHA512e4932adf10f0ec542e0775ef29a96f4eebe850c03ba93b2241b0a9877110f676476213ef38b18be29a5d7ce08a1a2aedfd50409610bef67950c19fba19464336
-
Filesize
208KB
MD5d207cd82e8402dec8379c073fb3570b4
SHA14a5776c57ca90ae5c04b80aafbba0c04fd9f8968
SHA25606ff379011b037d35e9212d697c7f9576ee98775121f9acbe98bc08f66b6d714
SHA512b69d62229b470b2fd00ae4b0752b573cb959085affb6f7db4bc3dd1f2f163d4327175ec95c69846a29d83d028b0eabd218650b34cd005b6b8880bd67a2f75737
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
796KB