Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
23/01/2025, 11:55
General
-
Target
f694c3d8271ef389f6a3db5bba04859a2bc2a6f4d4d9ac616133b2d1d4a277d0.exe
-
Size
208KB
-
MD5
08cfbd657d78b015b851df445f15425a
-
SHA1
2d85ed3a3c851b61c2b8f0fad7eeaf002f410aa8
-
SHA256
f694c3d8271ef389f6a3db5bba04859a2bc2a6f4d4d9ac616133b2d1d4a277d0
-
SHA512
aa3b65e8be5829ecacc18eea5db74af30abfc87e02b029170835bb367078c1ec24458d6d14183ed9d03c532cabc38462c14f8ff06e0801d2a415c2a942e2deb6
-
SSDEEP
6144:mJRDxRqdSqQts6iRZsTZuDbhivDVDN8zqF3F:mcjQKUZigDVJ5T
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f694c3d8271ef389f6a3db5bba04859a2bc2a6f4d4d9ac616133b2d1d4a277d0.exe"C:\Users\Admin\AppData\Local\Temp\f694c3d8271ef389f6a3db5bba04859a2bc2a6f4d4d9ac616133b2d1d4a277d0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5007b46003e2bbd579ec6a6b117e1c737
SHA12205003af02ab1b06c3268c4aacbd5d888cbe67e
SHA2560f93fd20bb9827e63c56723325576a2055e7809c072e2f599773a04b8c435d34
SHA51252ba55c0362384a65ca881081b87b70c0c8472758bcd004eff238147c74d85870d726fff33d1c466182c644315b4b1fdf2e3338e534007458129d9efe7c45f59
-
Filesize
24KB
MD50db09d67c9b234ad56846da147871716
SHA1e6162bc3632d08cfa292c57f00d282b69024d789
SHA256d517f4a68224317f4c82ae48415f7e5428f36c0fe2acf1d5830fdbe3bfe0834b
SHA5125e57a4095d10dec29cb3bf9a8e500de9ee8c6530af82e5fbaa6dad310d76928d8448a413dbdfa624d58d4fe244f9ede5e3e4b345db6c268dfa6a3dea47e8984d
-
Filesize
208KB
MD5c78126526d170c506ca394b61a62714d
SHA1aa07410abdae7f8ce289ec1e7e6cf8bf3bcebe31
SHA2563358e16ac51a99b65f73b352e86418e9fcff6afd6a7e9dac95a49c6c207f9e48
SHA512ca9bdc95d610000278c59618124a54af47b5e2e1b0b389aa65850aef881074374a3037e9ef4786c5262035f7bbd3227f19e88576e8be0bf50fbfa281ad08efff
-
Filesize
964KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
964KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
964KB
-
Filesize
728KB