Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
04/01/2025, 01:31
General
-
Target
ad8fc7607da8aac6a0a0f302f1d9408cc989ae177f4d1b1a4dd3091514b2731dN.exe
-
Size
212KB
-
MD5
72105d40f2e420df61201392508bf660
-
SHA1
3fcd87cb78a9ed2efed4d37c49fafd092675b3a5
-
SHA256
ad8fc7607da8aac6a0a0f302f1d9408cc989ae177f4d1b1a4dd3091514b2731d
-
SHA512
325d4475de9a3f9705de18726936cdc5d59d97b441988123a20a7cdbf3d9327ec095c2344f0d57e66649d9fdaca077be6a135e2de2e4c2b501f5982fa8a7c8a5
-
SSDEEP
6144:Iob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:XboEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad8fc7607da8aac6a0a0f302f1d9408cc989ae177f4d1b1a4dd3091514b2731dN.exe"C:\Users\Admin\AppData\Local\Temp\ad8fc7607da8aac6a0a0f302f1d9408cc989ae177f4d1b1a4dd3091514b2731dN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD579101c934a0f2cdd73923db8812459ef
SHA1c0bb5628bf5d41c28838c16793a307262dc9ac10
SHA2564874d9c0ad4c73953865bbcd181947901782310dc50a299655737248acf1b0cc
SHA5125a8501b21c2222baffbbf4c7449a751b90aac0623cd1560a72c5358f609d41df3918e08e746c29fc5a6eee5fa9b3e9ff077118279ee052666e07ca7cea526d5e
-
Filesize
212KB
MD569008d9f3a41dbce70c2142484128269
SHA14c2305ddcc6b8b4dae19db642827910faafa4508
SHA2569ba60bc81ad6a07a86d015ca761b7b1d7e576699265034a702c0a05fec6f0d62
SHA5128e3964cbfa426bc75cc6bd2988de7cc8636564da65b73193f3e737462fa21a572c1dd0cda82fdfdc46c4738dc9b1c13eaa6a389279ada575a3fb846cdaca8bd3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB