Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/03/2025, 08:48
General
-
Target
c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2.exe
-
Size
213KB
-
MD5
75465c8b7b9c2595465ddc13bfbb03ef
-
SHA1
bf388e942f68ac35421bc15304215d9d603b61f1
-
SHA256
c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2
-
SHA512
84e6b7bbbd1535c6f1c405662390a19af2baf4f7a9767f7529f390d5616c982f88fd3f806921f81ca69da5a20d7a43cccacb534f7b52d8c2e73c397e62189836
-
SSDEEP
6144:LQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:sXkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2.exe"C:\Users\Admin\AppData\Local\Temp\c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5f76e53c22b1e7ca640a16db73a7a4f77
SHA1aa1be23fe0a81d7f0a753c7e955e7425c5164c61
SHA256ce3378fa75f1c3fc98bc7ec4fdccdbb6211791a99dfff98bd65679fd61c1ec8d
SHA51233bc7aabed2dae7b06e0b5b72b6ea39596e9acd329cb020270b3c433a5c6d496df433b7037a5c0cbf42282ed16bf7f959816dcc6ee1f919bbdc357c6fdf4b4fa
-
Filesize
2KB
MD530e520d7085d7137bc6584b91a5a77fe
SHA10ca581082a3cb33c3b223ff180592178c3fe516c
SHA2560f9d1265ae58bdeb4e8199726975c00219df10bfde884be7176610ddcc7cf90c
SHA512d4f7c27b0b296ac65c51a346951303c1b452b74bf7a4436e3d21c8256d02f9e856c33697e739875dd0edf0b85c0938ba00865f10a82e6de20494a54f9c3aa694
-
Filesize
213KB
MD58f3f46924d3298cd127aa95cb3a78c37
SHA1358fc6ab69f90ec4795b28899c438f73c4871ba4
SHA256f8213b1b3f5b51bf0740226e490480e3f2d73f22ee039962ffe6b6624b29e30e
SHA512d4cd130f47058c1df4ed03b1d2e56ac4c41c08b6c3060a5b57cd2a0a16e1cb78cadbe9ca5412b7de6894a2a92dedf49d167c01fd3453defb37ac1739e2d7038b
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB