Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
15/03/2025, 06:41
General
-
Target
a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6.exe
-
Size
218KB
-
MD5
7fba57ef0d7e0e2f1662da2504c4a456
-
SHA1
d62c719bfbf0bddae07e4b7ccdee6374631b23ff
-
SHA256
a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6
-
SHA512
dd7ae4f449546c6853dd2400e0f1dbc5b3861fa864346fe797925ff33e8cbdfbdd86a764cbb482576a35a9d96a83cda9fc1751b6c246b7ce4a3d0d9e572695c1
-
SSDEEP
6144:tEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:tEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6.exe"C:\Users\Admin\AppData\Local\Temp\a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5f6826a0cd783807d7b0da75bda2a76ba
SHA13caa7d8479d9bd78d41eb420a4551341d45cb2fb
SHA2565992dfb6a408033ce29931145c354cfd6bcfabc0cc2e686498920589c179e5b9
SHA512e25ae66df5e8dd5355f45903444852540f77bcf3050b1a68c96020dbc2398954d5abafb9d7e137f4cfa2823e0dcd8a8ef07ce8b222b7b32f4971bbb937598596
-
Filesize
218KB
MD50fe3a96a95d4bebc28c41266216bd981
SHA1e59a01fbd8b6f3cb6f7445848db598b55a56b7fb
SHA2565662e0761cd7faf7165982ee509f340f7318e41e8c74dfb29df9fccfdf4975f5
SHA5120d6abc145b48ad96505426185d732d72c32aee5f53dfd07f6d7641e008147bcf6d4034841845b286b24fb8503def5a03d9473473d2860fda6b9c3926512bb5dc
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
2.8MB