Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25/12/2024, 18:54
General
-
Target
6f925c303c528b6da2ed021add26d46686aa15decf73ba5585fec04dfc3392beN.exe
-
Size
218KB
-
MD5
590447ca5bd1e0150b75110094e6b020
-
SHA1
15e5de75e841da41dfa0a2dfe86176f50636cf2e
-
SHA256
6f925c303c528b6da2ed021add26d46686aa15decf73ba5585fec04dfc3392be
-
SHA512
0b0eb11f2c9a92d5ba482500ba2d499d4ead0904d716e531baafd67cedaea243b34c53e3500d5c3a838ac8716c7764d2232bd9c3d2418a42799faf768e9062a8
-
SSDEEP
3072:Hvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:P1SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f925c303c528b6da2ed021add26d46686aa15decf73ba5585fec04dfc3392beN.exe"C:\Users\Admin\AppData\Local\Temp\6f925c303c528b6da2ed021add26d46686aa15decf73ba5585fec04dfc3392beN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD51234bf011914d0377912a959d54cc1ef
SHA1c68fe26b7b3254434b7a8c25547eea461c221bdc
SHA256bc97974ae148f891aee8ec8ceab4a69fc6edb07b8b32ec8d27612ece97163343
SHA5127f55e6b9598c7e299287a0c7812ffe090210eac84f58b9d6cdf9bb37a0160d718b85f4efa202da67edab1927d782a5b2b4458f3662f53342c71436975d7647d4
-
Filesize
218KB
MD507ba18283d4187700398f4834046fc39
SHA1dbb6548a11b6005c1d2f0ae850ce1f89db9756f7
SHA256aeaf7e8f8b2bdd735a0225d13bad25fda9c0ad74fc66fec093194cf85e7e9ced
SHA512003c2e2f167a34229dfcf9a6b5bf59887cfae37e76e6a623025abebbdbe08c6bcb2c8a649bd96e07889635e46f147417611193dce4be2304adba882b93c0de67
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB