Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19/12/2024, 02:56
General
-
Target
2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679.exe
-
Size
375KB
-
MD5
96511d1683e132d176807e03bbd7dea8
-
SHA1
5e55eddb19a0eb2791cdc20c4867130f081ba12c
-
SHA256
2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679
-
SHA512
9654d496ae1b5040f40639f1821abe18afde6d988e3855172c1fa76f5194d98044dcaa7c3adf2650dd5129e1fe6d5f24fb88344af85b19a469e57421fd91275f
-
SSDEEP
6144:z3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:AmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679.exe"C:\Users\Admin\AppData\Local\Temp\2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD515d7519e5e17c2ac218cab68cd2c4824
SHA151601c46d4820d7970b1e4702fb9de952335b9d5
SHA2564c563d7e5c2752e5a7fa40b238e6f6fbd8c16ee0a6dd723c3439b239e6d7f355
SHA512a92f9477e9a5b4b3bd9d01c81de548234cae34bfaa2032f39497566f8e51ceb2b67654bfbe0821c668710d4f061a75c542560914c3b5f21e6e3a0f1106cadd7d
-
Filesize
375KB
MD5c11de8ccd7bc40b8a3628716c5782586
SHA1ebf0068acd43ca65ae5d9a46d3d0779ed4d910ee
SHA256ae104b3055ed6021b29b06eba42a4b21bad9d596bd08bf65d4fd318cebfb0078
SHA5129ecccdf4fb7f7ecd60670706920a5fdfcc0627075d066851697a4e7962c344b8e86b8647a80fb8dd9929bf73df9e6182f03730db50d30a25319deed09164d5c5
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB