Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/01/2025, 06:51
General
-
Target
4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81.exe
-
Size
204KB
-
MD5
d3c77a58622b1f3ae3cc1e73b9a6c01b
-
SHA1
bbd5b6544ee69fe5f5320a4e32275b98d3c5b7cd
-
SHA256
4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81
-
SHA512
bebb23ed8370439d1de965ed6ae7f8bf6aa2235e8025a35b50447876ad32e56e3a7b29b00b16a01a2e6ce47f56d5a29c9c195ecf8e14c78febe4b6d29fbb3e5e
-
SSDEEP
3072:S5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:SLexkuRaX41xoyJV65gzyZko+uc7
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81.exe"C:\Users\Admin\AppData\Local\Temp\4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5acfc6ecd8b276f55faf91fcd37cd813f
SHA107b820d9f8c65da979d8baf21bd6af1188358216
SHA256899ad6f396467d73113d152a241747fe264000be966e2eb4bafd2df4aa07be47
SHA512a308eb4a89e210e71bb5fd6914f49faee11fabcbcb76b91cc9fb0a9c68fc34b88f3dd61e6c27bd939c4e794f29391c56fecb46870303a4f351e246a439c15913
-
Filesize
481B
MD5fbb03459f5f8c7e67e861af8ebdc8410
SHA186b1f90339daa3dd0975370f8289318dfaca1af3
SHA256a9b4565cdbd22e421ae27082676f0aeb054035b33ec2308134b3b7b03b6e2146
SHA512d83491ffae0d20cf04c30b709029072e406008c663c0ff65920afcd321d315990712cf7ba692b72bd2b0cef999851b6ecc137b8d3d997b0faed6eddd06fb4fc0
-
Filesize
204KB
MD505cd4565e1e470bf38cec4bf833388fb
SHA11e5287154bc51a47b320df0187a3258c2954c096
SHA256b850455ca13bfcfeeb1395523ba461a5d483760c79f320790d07e41c2286de62
SHA512040009de9e3f8ac8e220e59feb429c5931b06c3768978d364e4bd88b8b6a28beb6500112b539a142e00ea13b678f180ef75085cf21129e131f65da52e4270fba
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB