Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
19/12/2024, 02:43
General
-
Target
0c5c7fc5fa0e50f5ab876da00cb4fc1f07350faa11614184b5980579d1fb6beaN.exe
-
Size
355KB
-
MD5
2efe56585cc790206b6658cd90f9ad50
-
SHA1
740461f1665ac43290fe3cffa82b8c6b9f0c251c
-
SHA256
0c5c7fc5fa0e50f5ab876da00cb4fc1f07350faa11614184b5980579d1fb6bea
-
SHA512
87f4b7356055cc804fb9cdbcc35486454a0867a33fcaa1b993f47509849d21471d986b900ac3331c03fa074986a45e3e7c82c9cfcc6bc5fa8b85a8ec5e430b56
-
SSDEEP
6144:93EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:SmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c5c7fc5fa0e50f5ab876da00cb4fc1f07350faa11614184b5980579d1fb6beaN.exe"C:\Users\Admin\AppData\Local\Temp\0c5c7fc5fa0e50f5ab876da00cb4fc1f07350faa11614184b5980579d1fb6beaN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD585d9021538349a84aaaaa6a22385dec4
SHA15653084061da508238275de0641eb23c966962c2
SHA256e94c8d85d06ae1f971d9208de7a31dc9ff3e24d3903def61ae59b82f5844b148
SHA51218c2008f6dfee33d208b42f1825e79c1695e7fffd46e11c166a21c99d4fdffebd96164c033ca1386522429f92721aad90c5100a5269a45ef426f5b626c10c7ed
-
Filesize
1KB
MD5b8fc1a4d3390e1ada63858152b5d85fe
SHA101dcb95b76bad727fe7697d63678e114d7c7c1a3
SHA2560344c1bcd1a5ef0a2aafec05fe354a5c9b880b8cb20d5df41f4e18081b071a5c
SHA51237bce95c922aff0708e474824f9a453118a3f092823636f9d7d89c121845b5f682d952b39387786e24824289c35dd812f2c0ce9217fce59a8a0df9a3a5f6db45
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD50fb2b15e3fd9f7969b69be15e30b3613
SHA1ef797eb44b3e9c631cd2706f4d3ea6b321cb488f
SHA2562859a17f2d70decb420d67356278746d82b55234ecab6f121e13d2f81f18952f
SHA512d49a62cc0573f4daee78df41cdbfca43e851a439e9270f04205cf6808f2d12f490108f94bbfcf0374f5678038e3c7e5c833d52d4b903807bd420f9347ffa1707
-
Filesize
42KB
MD5dc4a21fe257fd8d91645fe515e999fca
SHA1b52a4ef642cde6c0b84f90d66fd350ff581e5b70
SHA2567c5b53da6b5b5a53f54c26ba47a4aa2dbc429ab1db325fecf6f2e60ccbc2cfe3
SHA5127c6d8f9e3b5e56c02df7f948750dde0988a9e3cbc71687e3ed31fbd004581c95c281956ce60cce711415bce2b881e22c71bbe7ed5d3b7fa0a842e54d7d69cbba
-
Filesize
355KB
MD5a5939c9f1398a75185aad5c5c31b63f9
SHA1efdd415aaeef4b4c37785386e01841c33466561f
SHA25644ae9a92f6ec35c34b919cf9e6c8ead11eb3df0dc7051a81cf22890836767d6e
SHA512e30078597829ad859c0f69c56a60f3709a4f5afa3c75adf0a9dfde356b2dc2ac5a13c68d3d9162e227d9ea4a96b0078caa774c3811ca04df839a4a5af0a76ed5
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB