Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/01/2025, 00:06
General
-
Target
99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39bN.exe
-
Size
355KB
-
MD5
a03e9c3d53132e9d5fb94bc1f9d0e110
-
SHA1
7ef9a622ef0b708d66e4e32954859629e8319010
-
SHA256
99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39b
-
SHA512
6db79038f42a80c23f9b98683785c993fdc2473e189008ea2c75ca5bbfd15cf1a5fbb65a5557617db435519ef67cfd92070f51839a47fc45e64e5ec86e638cb7
-
SSDEEP
6144:Y3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:jmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39bN.exe"C:\Users\Admin\AppData\Local\Temp\99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39bN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5103638106cebc206f0288f5c3f65082f
SHA1bf3f40b28ea3127456fd769feec91bbf7f6100c1
SHA2568d77bca06a9334c595fb3c56e8ee2e77d49cc7f4725e91022d20aea5f727ab99
SHA51204f8e219c2b355c80283e1324fd548b62b4416d68713e29dc23bf6a8dc870c97a0a13272fe59b071bb6f9c28312db64b50e7c0c1da28e84319c4c8615cebb5ae
-
Filesize
42KB
MD5c8742af6398c2c0fda8132c4a7843699
SHA15f4a2793e1b49c11d11b0476d17ecb9939826990
SHA256ffdbb6ca2fe426d63bb5e9f274436c6803f55cf6d9edb7fc6f1e6c193a945753
SHA512cb006ae52bbcb59def80101744d44b52f47b7ad2b96c62907efad0899e7f09f9b393e56666f1ff30c2fc7b56e3d14967a0bcee673ad60b7d764ef22620b55686
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
355KB
MD5d825b303eba53bfa7ce0fd98aa662740
SHA13fb4f98f6c348d35ed5d1fcdaf96ec168e548e6f
SHA256050907dd5b45ec372446c40c6de5db45906d211acfed9bf56a33b3aad9734c4e
SHA51285985f7741e1a7eb9e84e15ab5067634198f48e217341c5e21782e6143ec9555da5bbcb9dedf8322fb72ef6f482fa73c386e734802c881f0637775737d1a3942
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB