Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18/01/2025, 09:09
General
-
Target
baf2e4ba357be1ce9ae98ea82693a35d6384997331b39dd186e6bfbb811e11bc.exe
-
Size
217KB
-
MD5
db02ab47da3688a7bc69aac371da0284
-
SHA1
2eca6aef8d19eb1d41b520bf8af7502482724f73
-
SHA256
baf2e4ba357be1ce9ae98ea82693a35d6384997331b39dd186e6bfbb811e11bc
-
SHA512
2e8a65de8b23f7048b6ea9bfc244ce75beefc35f4981a6f4dc14e9b367396cd15416878929fabac8d8ec3995a8c35e3c6a03b412ab3a57e7b3648cc6fcd46f77
-
SSDEEP
6144:2rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:ksTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\baf2e4ba357be1ce9ae98ea82693a35d6384997331b39dd186e6bfbb811e11bc.exe"C:\Users\Admin\AppData\Local\Temp\baf2e4ba357be1ce9ae98ea82693a35d6384997331b39dd186e6bfbb811e11bc.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD53b37a30eb405274c11019713c46860a2
SHA12a3a7fdfa4fdf561b189da2a48bfe9fb5e315e82
SHA256c3d365fdc1b4f2a3325cd815ff298e204db2d6e72054b0741b377ad6950265eb
SHA512f20aa87171606ee656e92b83c9a83086b3f0d8ffef1a082a755d388da6f44a8e5326652ae0ca7304d6adce0c7703c3ecc5ac80a0f017cc3670ba64b4d87792fb
-
Filesize
217KB
MD507beb947679a0539b701926d19df25d1
SHA1face25e85bc9fa108dbd0a0c52fd4e2c3320834d
SHA256bfef30553aa0ffe33c7abad91742678c01ee9cf412197a3731db14d460a79380
SHA512afd4b450c57b3e8e5fb4585c0e196b02aa296909b96df2a4bf6b064da0642fd946da202672d285496b670af17843a3103d2fe521eb7b59cb9b269caa6d920724
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB