Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/12/2024, 11:51
General
-
Target
f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011N.exe
-
Size
217KB
-
MD5
e9f824216eb8070b3c9ff05d413ac560
-
SHA1
80ee926652a7a7feaf24fe16fe2847350ec978ee
-
SHA256
f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011
-
SHA512
687fe39108da2f5618984f25d410a044a3433e408de9cf60c008dbd99c35b742dc95487d0d4e00ad06a043812a2405e5de0cfa36f4ab3d062a8762c4aa204e60
-
SSDEEP
6144:7rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:HsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011N.exe"C:\Users\Admin\AppData\Local\Temp\f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011N.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ecd8d9a90d198406d2f4e268ed1334c
SHA1beea0ab99c7590f45cdf3d06e6f04a57cf6f3ea3
SHA256745223a12ce796118b1b44c576cada6a9d43f941fc6e5b2235321e3ec8959367
SHA512833ee9b3641a6182fa561d8b1933e24aa359c81c3c48ca18c86c5a45196db45e39d59cc614b18f868e4215f82ede3788235145b1eca58766a0faec4344e8e866
-
Filesize
42KB
MD57b4a703aadb7b55c2c24d048be35e646
SHA130d5d5c9337a9ae32892bdd9122dde7526f14e7c
SHA256913d40893d4e245acaab80ac5da6dedf40d41504f7ebb37dca925d5a0245f072
SHA5129c88be594853ce44fa172aca258680ce1d6f3cd422a6bc96d9c2edd375d5705fdafa2937d157c731ae003125572848099ffa11f2b6fc3fa8c2b6abffbfbb6c60
-
Filesize
217KB
MD547b3a3649d829409b909b289bcfd3416
SHA106ab95cbeaa0fc200c1573751ccfab0c09671ff3
SHA2567b06abaab828ac58a4e6af70b7702d01fa9cb2eefb7fb96e56f17044eaf3aea0
SHA512356568bbc7d6c490bb46c3b88c93e4036f21045a0e20317eb87f3105feb14d72231943a07bb7dc374d74c03c576ec2813c7844e4acbc9c7725076d8aa98be227
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB