Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/12/2024, 20:16
General
-
Target
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe
-
Size
217KB
-
MD5
b094ceff6d937a4283d50d0dc406d203
-
SHA1
f4edf55840be139785500f72f23310220d8ebf1d
-
SHA256
a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936
-
SHA512
09e158b2939dbfdc6ef03c2d0612ac2a4ae9cdaa3c9171379b306a58fc6bf5388f1f9e888b7658a6bc2018aaa68000a9e851dbcc08b67c4283932331dc69c560
-
SSDEEP
6144:urRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:csTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"C:\Users\Admin\AppData\Local\Temp\a92bfd0bf6d71fcb1942a8160a4a57ae6424533079dddd380736e4b6db16e936.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD553a79aa19520c6975eb22aa4a41cdfe6
SHA1c25d7b92fecc0a849a6aed50694dc370772b48e5
SHA2566c232f3d9fdd86299f660171e94b5c5a6faf378e35b17fb7da0c21701dcbb039
SHA5127577f74d3aacc3979f74fe23ad3e2a6228fd8bd40213ced20f4ff7d67e771b930d52e94d03ab5ebd96e47ddb6acaed9a50f14f0af854df4bfd459bc9f9ac8ce5
-
Filesize
42KB
MD5dd05bdabe842f6c98ceb04c3f824a97b
SHA1557f42fd3bf993b6ad609e26b7f15763408e4c5c
SHA256834b1b0dae94e974f165b4b3046eba8a7b0c8e68e6dff9a66492581e789c6fca
SHA5120ce488b65c1faa4228150bf4da2a6a367ce632ce71b2e5f8cc8b9e18f94132c8be64c28a97eceb329aea8fbad85fa6f04a6c11cee49f54313b3b087b280e5c92
-
Filesize
481B
MD55fef185dd277d45a0ed43e9ae054690b
SHA173786318a4e164d9bf79dc193a17eb627d4fe7d3
SHA256a704c8564ba95a0c49fe7106979dc43115cc0351b2091f7afcce2bfcb4eb5c49
SHA512367f5e0fbb7b5923cf57c6c9fcf973c7c2d8ecd113f000919f6921a1370766444c590061be00db67394f4621a351f6b5ef8bb44f0583c28ba090ac39ddeb4138
-
Filesize
217KB
MD5dc9a451d1e5132b893a27913b25a1d20
SHA1261bc465201e067dcc2b82ed83f41d36567f7128
SHA256a0d1d3fa9c49135c5482eb972b108ff2616c345ac961ee9d93cf21581ce18c13
SHA5120d11796fa9ad943732de48be230cb781eac091935b9bffb802018f93bb7a0316dfc5809b7fc3ab9fe9a606f9e86d301851459eea6919aef3a2a5dd03be484132
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB