Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/01/2025, 17:52
General
-
Target
020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb.exe
-
Size
208KB
-
MD5
a6a7e7b150eb46f192c4ef733a4542a0
-
SHA1
d81d8e12a465a1a5b65b1cc00c3504ffbef2d032
-
SHA256
020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb
-
SHA512
c9fb2ab2198a07eb217dddc3bc5e332be8cc51306f020b2c4e1b07efb3468c7ba7a8c1b7b5ef8c1a23f832ef185d059d8be6e7e691c9fe30a0c84cf50770c30a
-
SSDEEP
6144:ya1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkg:ybapK0JCmRcU9vVokfB
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb.exe"C:\Users\Admin\AppData\Local\Temp\020702d4c03e110898e9beda4de7da2463879f4e04e01f09488dc40a78be22eb.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5d4219fbf9d73944bdf5c5acfd9761cee
SHA1cc65c97914919f466c32eeba66f7b91a4b4164db
SHA256605204c351fd0e5a2e73863f99af236a9a53032cdcc7242fe65466d7d36c3c59
SHA5128648bc7d8f63ffd81b37300adfeb2dbbfeb3c8efe9e89aaeb7458e4f77d098457def2c10cfa776ccb5054514898d9a267549f5e7cc20e9a787abef13a550a3a5
-
Filesize
208KB
MD5a29bf7c6899a27116a2fc5b9a3906e74
SHA1d9650dc430b64d03f5a7a83d0cfbf5e2321d9dd2
SHA256e909d4495e12601e1a5cdebf2243f3c2efc1c76d8d928f886b33d2679e6d22d9
SHA5122c0bafdbc6a21b62f85eee9d9c87639b4f569c17522fdde5f31d5de2c02aadcc405188719c0bca1abb22635e6179dde9a6e85be51ea917d078c74c84364ac3cc
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB