Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/01/2025, 08:11
General
-
Target
6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02fN.exe
-
Size
212KB
-
MD5
5b8bbe2c2b7e463f37570faeffe07f90
-
SHA1
f59a3a1ada84df57fee2cf1a4092ce597b2db961
-
SHA256
6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02f
-
SHA512
7b808666274dff0b7ab1238766844385ffc5a3a880370ae4c9933ee983c59e10e6445ee27eb35fc5be1272d930168769314a8896eb012021c3f906b31b3217ba
-
SSDEEP
6144:tob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:yboEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02fN.exe"C:\Users\Admin\AppData\Local\Temp\6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02fN.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5fd444b4d40c10b26b32dd30c5c09d30f
SHA1baff9f788c411623cc917fa510d4d10185581141
SHA256b6af1e6d9ed83046abca04afe13920b2d4270bccb4d1f4907571000ed25d99bf
SHA51267d9a46ddfa17e75097e5c07ad6684f32f4ea34f79e693221c5e2efa1685cff2f81ca0be6d2c6ea6154c7bf6e85af959ee1f2181ffd860d7122fddccc5f441dc
-
Filesize
481B
MD514456af192fa353419cb9917a3bb3de1
SHA155958ff04157d660b57e8a5b54f95693b0d1f36c
SHA2569465682354f4bc166b01aea28f7a59ab5800243e4f62c0ed809e25f5e2038a60
SHA51233705634dcc36d0edb1574352bec75fa5e77510ae4c8b0d8a793cbecc8db9cf65ad1e0893d2f8b3501322489240273ef2bc4e0ebcb5427ed0bd173bf45d65718
-
Filesize
212KB
MD5a1876ecb7dd6e606cd485082eb770cfc
SHA1dddd5df2b30ecddd4d4d69c164b54e023044abe0
SHA256c526a9cd7edfa5d437808751f93b883cf69d27081a299e8291f680e342b043c2
SHA512f77c1f7cb3d5e16a7b354cf3dbf328f157c9bd015e0b575fbe03ba0cc9e2f1048e42cec21b846ca8f884f780c1825681e5582338fd1787eff0fa0519db8dde16
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB