Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/12/2024, 02:51
General
-
Target
aea9e4d96d8aac58e16e93be0ca75c46ebd45d160e4afdac08985d573b67709e.exe
-
Size
208KB
-
MD5
5aa04a2d2bada2b5a682d6a14a3a4f16
-
SHA1
44115345f0dcbfea927b2eeb6c25343bc30dbf1b
-
SHA256
aea9e4d96d8aac58e16e93be0ca75c46ebd45d160e4afdac08985d573b67709e
-
SHA512
61865ba3b0b7fd496f742905064fb644ca8dd6004383125ae5550d348a01039e0f99389fdea82362e89ced1918e4bdabcb5c9bf7a188b2a38ea905885f8e243c
-
SSDEEP
6144:uOYX27lPBA3YDMw4lj6idlMlwl7/79C87g:uwBAy0rlMI5S
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aea9e4d96d8aac58e16e93be0ca75c46ebd45d160e4afdac08985d573b67709e.exe"C:\Users\Admin\AppData\Local\Temp\aea9e4d96d8aac58e16e93be0ca75c46ebd45d160e4afdac08985d573b67709e.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD50c3cc8cab7e57eb725944368b0f55cf4
SHA1557081ca07dd0739b2da745f282da9c1113b466d
SHA256357258bc7d7068e3e36440a04d4c4681eaa4474fcfddbfab2f8feccfa9a48549
SHA5124d8377c36f6c65e60787750e4c54bd24e90f111d2bfa14808140355b76663cf0a9b61135dcd62a335870afc0f2d841da320a6ed2ef75818202e3a7ca5c55a841
-
Filesize
208KB
MD511c4e0dbdd32e18a2fab9864c7f52765
SHA103cdf9cb3b83e669e54884d153ad0b2488d07342
SHA25643b0db6fae34d7c00a21af758b78f31e3123982ae290c3757732577664d56a89
SHA5124daf48488cf64c2a43206c41b65574d89b539fc61750708c08cc66126f1d4a7886400538d6ac7c8d76d60b271d53d664f063de79069900917812d5a6810ef11b
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB