Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
31/12/2024, 14:42
General
-
Target
2889c1f01dfb895d83afc561dff932e4f049e35e333224d219df20339f9bc231.exe
-
Size
218KB
-
MD5
62ca8098c10ec0cef2c0f7ae092bb5d5
-
SHA1
e9a6bd75c00aa492e0860458e984009185dafde6
-
SHA256
2889c1f01dfb895d83afc561dff932e4f049e35e333224d219df20339f9bc231
-
SHA512
2afbd9b32d86974947dc095dec9604a8e4e32f6b9062f04b3f1d5e3c390627deb7b9b356695cacd70527c97cdc87ddcb7a97cc045ffb0bdf0234fee7d0c051f5
-
SSDEEP
3072:Qvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:+1SyAJp6rjn1gOObn4b6h9B
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2889c1f01dfb895d83afc561dff932e4f049e35e333224d219df20339f9bc231.exe"C:\Users\Admin\AppData\Local\Temp\2889c1f01dfb895d83afc561dff932e4f049e35e333224d219df20339f9bc231.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5c41991c9adfcf5455c33a6cf68f29d19
SHA1d136d0b0f3c1d8920c897c43bc69bc643277eb5a
SHA256c23501d9b55beca576d3d50505be73334e567f5b12e32179ba0e2a9e5b86fb1a
SHA5128e43cdf2a569f916925c09fb09c00956dc5af5c8ac54db7fbad0890bfce747fc007319e59b41172c53c409c255ef4fa208a75919b6ceb4b1506e8843b71333f8
-
Filesize
218KB
MD56703c98703f6a69c9c02eef6fb463e36
SHA10a526467dd2354df1e630fe7c69138f335561673
SHA2562343a29453c3138a5c97ca09e58ca6bd1f77aa6adeafa31355a54cbaa9110de0
SHA512be0d477ebb47926d76f59b50abd0dcd1ccf1dda8d9c090cc5db0b513561d93bc0248ba1479fb1308e44d0f0253260d82b76f7426f0b4d5be871446fe0b301572
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB