Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/12/2024, 07:33
General
-
Target
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe
-
Size
208KB
-
MD5
1ae630c9073650cfadaf1ce8a2500ff1
-
SHA1
f6719008bec7a1f9c52557f3ca6cf5301dd0ae35
-
SHA256
c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77
-
SHA512
07ed34719dc16f95a13a928cf03fcecc8f375328caf012e4e399a1ca51eb0ec4de01c24cf8cd5c637afa9778b3c4534632a3e39c2e95161a792304bb3043e72b
-
SSDEEP
6144:BOYX27lPBA3YDMw4lj6idlMlwl7/79C87A:BwBAy0rlMI5i
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"C:\Users\Admin\AppData\Local\Temp\c2746b28601e182b3b7c6791208377a9e9cb8895993bf9df89fec48be8401a77.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5de06ca0b79a491139aea8b0314a4ccea
SHA1afbbceb2c13b0303c824cce96eb2f30d606a440c
SHA256b80b9eb17d14514b57fa7fc39c8d48d342e6c990f524a1383ae84e54f4adb026
SHA512fd0cba21be210ee9d0f1bedc66b16c78527f8ac61b1d03eb22ad5189fee65f7a56128de9edc7ad77dd509447bee7596806c222fa1b9ae81d101c4202d820118b
-
Filesize
208KB
MD510cc3dcbe9038592c1109d0ecb81f579
SHA18f33e5d12000d9c011c0cb7ea750d7e71fa4c4a8
SHA256f433386e9d44d7c73df67a9a288a2dbadc1e04ecaf5a39641eb79ff0ffd1065d
SHA512037edd0496525342c5ef0688f8d3e5776e78ac5d7ebc944493f2cf81bd962d5bd97c56819de26dfd197cbd29037889fda59d9dc404792988634da9f367b4c0e8
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
380KB
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
380KB