Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18/03/2025, 11:49
General
-
Target
d54bb9dcd9b3147f3b48abf66d2cf5e1daeb8d0971445be6f8410a621fb8e3b8.exe
-
Size
218KB
-
MD5
54d4e120a771df0f8fd0b6cc136a5184
-
SHA1
c703b958e0f4cdfa1f0caac7cf6028d5480541fe
-
SHA256
d54bb9dcd9b3147f3b48abf66d2cf5e1daeb8d0971445be6f8410a621fb8e3b8
-
SHA512
b5372a17d11be1450774ff65e4bf5a42198e2c97f83c673bf8521ae5e6a2056727230d5a431df727f7ae1466c83024ce76d8bd44c9ba7efaf0f492f727f8e7b1
-
SSDEEP
3072:qvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:81SyAJp6rjn1gOObn4b6h9h
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d54bb9dcd9b3147f3b48abf66d2cf5e1daeb8d0971445be6f8410a621fb8e3b8.exe"C:\Users\Admin\AppData\Local\Temp\d54bb9dcd9b3147f3b48abf66d2cf5e1daeb8d0971445be6f8410a621fb8e3b8.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD53c8e998cba9c8a2c65fcc4aa7891548c
SHA1ead80adafb4272ce0e5c75a037782454371a27ae
SHA256d3b21b4525d8869bf253e9821fb75590d064942e215cb3fbf08ca234fc6714a7
SHA51290ac19f0520ac10a2b755e67cdf6ef2e695fde81236e576c0f7f87224335957d79179523bccb011464bb0ff44c728cb57f6232441a5a362c821cf9be0524c455
-
Filesize
481B
MD5993748395e7f28a39e2e6f88387e3449
SHA165e21b00d573a8c7f47c56c62d0c83aa4f70315f
SHA2565d0affa57c1a0aaf4d2d693dc25053e10ce0a106c72daa6c7230b8203a8f230d
SHA512dc0c6bf935fcaeee6029f18c78e14c53167c1dfa778622dbf5a3cfbf93794ab6454f14d3662cb303ed856b3737ed3a45af2fe110eeb6821f0f52a2b233191c1e
-
Filesize
28KB
MD5710b6052085d83fecf2783d69dd882a6
SHA1e3610c2d419a101c85361f34ade9476b19da46d6
SHA2563c65d20776d21bf26f2887592a056d47ce6ebb58adf1e9a4836a91eb2f1da834
SHA512b93f6e788c417bd669407ddac4179796549fcd17ae95477d3c7640b360ae863346a944c4e5c13c434f9ec5f55dcbf6e81bb222a460882c4a33b9d28f76516b30
-
Filesize
218KB
MD50d59dbd753205cfae657c72dbfa37511
SHA1933e983f7f53a00c3ca587b6015f770ad984ff1a
SHA25632a5351f1bfa1cb3f3fca97e166ddebdaa9d6dbfeddad42e9f15a25b22ce692b
SHA512fd7a3c39362e73ec1adc19df218b077cc4b6a165b10c3e50ae3210c9efd3bfe4d22b4971cefaf2a00e55da235b60af2ba845e01f48b8e24f5b7475dd4266d80d
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB