Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17/03/2025, 19:41
General
-
Target
0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe.exe
-
Size
212KB
-
MD5
5a4791ac48468e167a01886347e3b97c
-
SHA1
bc07b37df81e83db17043911356d3bab7fedb719
-
SHA256
0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe
-
SHA512
d36be2957e914fd31700608dbc5ebb4781d27af406231c1f2506e568bc2ea2cb284058be475bd22122c28fe4167586d60a73950b100b0dcdac3c1b67b99a760b
-
SSDEEP
3072:XGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:XG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe.exe"C:\Users\Admin\AppData\Local\Temp\0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD53c8e998cba9c8a2c65fcc4aa7891548c
SHA1ead80adafb4272ce0e5c75a037782454371a27ae
SHA256d3b21b4525d8869bf253e9821fb75590d064942e215cb3fbf08ca234fc6714a7
SHA51290ac19f0520ac10a2b755e67cdf6ef2e695fde81236e576c0f7f87224335957d79179523bccb011464bb0ff44c728cb57f6232441a5a362c821cf9be0524c455
-
Filesize
24KB
MD5c6eeb1c4325eef823c557a44261ea5a3
SHA15f6053fb08cbb214bc56187e8f6cadd9532233e6
SHA256d364b2bc224618804f2ec56598cf173e25b8e9844c66a32ea8a2a9a11fe5a377
SHA5127d0bd86b4270a4507f4f89bbfb58a5685ba1a3024709f3432f19fd9b82b1706f1bbb510c9e7e0d6254a17b3755a1397d9296b12b8b8ae34fb68906e3a87edd9a
-
Filesize
481B
MD5d71170235eabe02a791fc02b55a60d2a
SHA16719fe68dd790dff4edb0fb74c5ce36dfa81806b
SHA256e293eef65461d50b9239ba4dd86a7cde36c1c66cb13b2d950a07ee441382d537
SHA5123c8ac363d82d0970d465f47f676468cbf2283900818019cf6b54bbaa7e33152d7cc367f0e7e71a203a69864e35a692e0424952193f2788649de2d9ea44907bcb
-
Filesize
1KB
MD513a1f5a622c81ba4afce73993fc438f4
SHA14723ee4b6d1824c11556b6fe68455e67afda9289
SHA256ff3583f97da5fd89682e7d89407bd87ded9396b8986154fef2139882ccd0d6c6
SHA5127b178344ebae9fdb16853302e6f482365badef7bb19b2f63c9957c2b7f4d7b233d7734b351bf9127764eb0d45fe48ab855b1ec1a4d9d5eee14dcc336daea37bf
-
Filesize
212KB
MD5d256a26987661003e8b5342e6e08705f
SHA1863d8d68fec7df67ff3e6183999c262c4150be80
SHA2566751585cf8e56549f2fb2c6f54a579500b4636d8f4b71dbe89c053b32a6a361c
SHA5121f2645ea82560f77b51161ebd97642271fa6348be808767fb80f5287760da458aad24d78d8b75632ae083d1e84bc2cc90db20888a1a91dac838a75faccb52139
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB