Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05/12/2024, 20:02
General
-
Target
04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b.exe
-
Size
217KB
-
MD5
2ba798fb98142f5d6467eed2b70ac5d1
-
SHA1
07e4c15044596f011d785fa0d2c08a0b365a0402
-
SHA256
04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b
-
SHA512
69a42725dae453e334ea6a33918a012244445e93aaddcb884df16088a1e6f3fe3247ac5ed2840a6a406a3dcf1eee52304e82b80742a7f469e2f0916ac63fbba9
-
SSDEEP
6144:qrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:wsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b.exe"C:\Users\Admin\AppData\Local\Temp\04d856c4c30fe63a9a73eefbfbb50a340599e17b523cd0f4d552df52260f3b2b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD59c7c2c8b4c49c69fd848d9dcd1de8774
SHA140a2e701045c8505ceb0f32b2f316e9f8635b4b1
SHA256740bd3de082e4020f1967f3792298a4dc8df23dfee480ff33369108f3d3b675a
SHA512ec665d5eae3c4cdccd499898ee31bcdc13182dd3b3d01ee98cc90ad9e8435ab2bf1aa673b83866a33a2de8d091604dd30710d9eeadf2c93ade5af1b4d1e09af9
-
Filesize
1KB
MD527e5a9610e8110170253bf39ad3bd114
SHA12e0f4968ef3732ab5ec9538704e9c39b7036f629
SHA256a1025ca3fd1ddd0635244c985aff31d37eccd6858f72e6df11d4cc7367677724
SHA5123a68725041fd750ef01c385f50a28f3230e544c612910a5473c61b1a27fc008021046bb85aa02b14555dcfe6ab24d299ccac319b18e240b4a2b605956fb5f655
-
Filesize
24KB
MD574fceb561821f2abd554886e6e844cfd
SHA17116cd6082bdfe78b400123ded559e05ae7ca94d
SHA25601a0bf1c5c55a4a8a351cbf2dc59d428edfcb08943656bbe40561379738d177a
SHA51221d422cdca641d2f496728cbe214e594c50220ade305949178dcf147f3e44b305bdd78d13396d5652f17759aaea30eecc15bee61dc11d18407d6e64f98683a16
-
Filesize
217KB
MD5d7e2d096c7b90c83b8d120964da9fa35
SHA1fc2297093a949b557b0f35059434015ee3baa53e
SHA256b9c917ab87a7327918a1af6c003f8d71727b45c1a8b846f3be3f057185be5635
SHA5129356f7bb38a7b7d58d663162c2e6a9788af04665901085aef0c13b25db68ce176a78d5b70a018567723f555ced63cdbc110825bd3487643741f2e9e09e9c05bf
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB