Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05/12/2024, 12:35
General
-
Target
5a6d6a9070475d9e024042ea5c5d810d8c6c927ae3d833d3230cec0817ef15ea.exe
-
Size
218KB
-
MD5
5694c58979e5b13317421078dab02aa9
-
SHA1
5e0e6633a32dd4967ed806fc536cefef52b9fd82
-
SHA256
5a6d6a9070475d9e024042ea5c5d810d8c6c927ae3d833d3230cec0817ef15ea
-
SHA512
1964a703ec7c96f73376853d82df2d7c278c969bebdd35e403f81a51500895843abcad59c89d0c30baa412d8e8fa0213974d9c1e2d7786cfec4aae4820ff8f90
-
SSDEEP
3072:cvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:a1SyAJp6rjn1gOObn4b6h9x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a6d6a9070475d9e024042ea5c5d810d8c6c927ae3d833d3230cec0817ef15ea.exe"C:\Users\Admin\AppData\Local\Temp\5a6d6a9070475d9e024042ea5c5d810d8c6c927ae3d833d3230cec0817ef15ea.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5714731de01bba24103e308dedb5a6264
SHA1c5ac205dc632ebce42c739e8561022e31cd60555
SHA2563c207c5f7e913d6a86f9f46e3e15f3a673a0c5ecd78f9cdcfdba12cb600a1cbb
SHA51246925dd37fca024db186eabf8117ab31b8d2233af01b3c8ea1ed60565c3cc3b3717303f26b296d81d88a0a05d168de4a37a9849a02adc88903fb58aa97c29b16
-
Filesize
218KB
MD5488879f062fecf77f75642bcdc6de8bc
SHA1eac6a2c49cb6abe84137fb6073aba6a8091150b5
SHA2569b6fe302a7186c70c4cfdd273c0961de4e710ca905794e5d9faa7689c83b6303
SHA512b9f4de665acc1c500efde0ed7278a49cb6077973f1e522a4623d395b31e429c178959b6f646bf42c2b76b350101730a62e923304f2871a3e7f9e3eb33760cebe
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB