Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0c4355e5c0056708d37af7675030d08f_JaffaCakes118

  • Size

    254KB

  • Sample

    241002-yqrq9stfmp

  • MD5

    0c4355e5c0056708d37af7675030d08f

  • SHA1

    8dfd0ac5da798921cf63a0644f7e18a3ed3c442b

  • SHA256

    96f80b7a58c6cbd7abdbd986ae3afcadb983b5fa1e59dc249f91ce588201a205

  • SHA512

    134a312bf875f912df750c5b69d25a4bc0f6ef7ab78a11bd214734f4aa99c8c8e5102844da385b466f6dbb7bbd26ca3f525eb73b496c5170e7b723e9b91b45bf

  • SSDEEP

    6144:pMDzfNmz6rIPGk0gFdJvbizOz8mg+es9ejK8FU:pwzfNu3Ok0gFdJGzc8LDaejzU

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      0c4355e5c0056708d37af7675030d08f_JaffaCakes118

    • Size

      254KB

    • MD5

      0c4355e5c0056708d37af7675030d08f

    • SHA1

      8dfd0ac5da798921cf63a0644f7e18a3ed3c442b

    • SHA256

      96f80b7a58c6cbd7abdbd986ae3afcadb983b5fa1e59dc249f91ce588201a205

    • SHA512

      134a312bf875f912df750c5b69d25a4bc0f6ef7ab78a11bd214734f4aa99c8c8e5102844da385b466f6dbb7bbd26ca3f525eb73b496c5170e7b723e9b91b45bf

    • SSDEEP

      6144:pMDzfNmz6rIPGk0gFdJvbizOz8mg+es9ejK8FU:pwzfNu3Ok0gFdJGzc8LDaejzU

    • Modifies WinLogon for persistence

    • simda

      Simda is an infostealer written in C++.

    • Adds Run key to start application

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks