Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/01/2025, 08:04
General
-
Target
5069f6b10ca689bc926ca99bbf06c0a2f7d8bf6530c3fc4892722677480b7d3fN.exe
-
Size
217KB
-
MD5
fa69878cede35f66ffd209a856943c20
-
SHA1
64c106c55da51acc94f51d78e4f5b2842c6d9f53
-
SHA256
5069f6b10ca689bc926ca99bbf06c0a2f7d8bf6530c3fc4892722677480b7d3f
-
SHA512
0943dba00062531f0a611776aa25e403d4320e82593d3fb9b5fa52389b42e0a175b42fe2a046ce31302f8e238ecca577e9776191b57eb801ed3e7c77d4c7ffe5
-
SSDEEP
6144:/rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:DsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5069f6b10ca689bc926ca99bbf06c0a2f7d8bf6530c3fc4892722677480b7d3fN.exe"C:\Users\Admin\AppData\Local\Temp\5069f6b10ca689bc926ca99bbf06c0a2f7d8bf6530c3fc4892722677480b7d3fN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5f63f34a7da262f4eb1c89c1a2428e8b4
SHA1418f402f2d256d766e80197831154821eb7b7e8b
SHA2566c84e6ddef1b4c6efc8a5852f3329c9f31d234edc8ec4eb88865a7400f217398
SHA5128b80cac7bd9fa5df4391f211600607eddfb95ee10477e69168e5dfba34746e86a457ad57b0deaebabc42f4f7ef9cc604f8284076945a6603a80abeeea7a1d66b
-
Filesize
217KB
MD50bc520848e3a5a8241a3a5ba9db5eba0
SHA19d0594e7f55e1f9312d334b0235feef77371a974
SHA2561c6bc45b76b06ea91bb0a4ffe67c5e95b82fce8a8a521c619979cb92eebc9734
SHA512de1ab50d8aa7476401c919ff58d73c03f6dbf8dd71c6e5cac441b3677f7c758088d35930db81bd5cba92aff97d915eebba6d93e315cd5f2103863515402f3269
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB