Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06/12/2024, 02:03
General
-
Target
c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe
-
Size
217KB
-
MD5
0ec4e7beb77023e14bd5a4c00903efc7
-
SHA1
3d7ccc8483e0d4f537d7f7e40c00d11fdce6aa3b
-
SHA256
c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4
-
SHA512
3975d018a9f616bac76b36659b79e26d3477a2dac5f4e1294e2992f6a5899f5c26b5dfeffe4bc9c60e2af7e40bb4c698f36237a8a120b5bf9d02e9fa85629cea
-
SSDEEP
6144:VrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:FsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe"C:\Users\Admin\AppData\Local\Temp\c4bd40e3ae7bcd6f833f339007e1752519bf5604f3dcb9dc09873912497578d4.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD515b7b42fa0e4f9002532d355d52ce082
SHA1e505853b5a95e80ff645d012218b0eb5812bd417
SHA25646c013616bb281848104cebbe6bffef643aec9395faf1ee30fb581c7a90e2b98
SHA512b1b6a7074348de97c3d412656b70fb5cf8ae7762608db9c00c0354babaecad601c70a17f2ce33f59e611d50a8f7ea16b79c4dbf6488869ea14e13c753bcc7b3e
-
Filesize
1KB
MD55bc91b4810e0739ca6f77baacbf94dd2
SHA14306c05371d0997ee82d251deac73183fd36ddd4
SHA256c95f8e4b55874c5f827230489a22171114baf277602a00d9bb56d889bb0d630c
SHA5126115fb67470f929b313b68ea07e13c47db98801219dd828fb0cd6e1e47f2473714b9b0dc8e2cf52ea619ac901571bd4175dac7048ecd832b71252bd39b854298
-
Filesize
217KB
MD5d56139ec3042dab605f5f71cba5c89d1
SHA186a264f913831fae031e6065de77a992fe1e3690
SHA2563711eb331404f1f8eb4a19cd84d480d794fbc6b89c0f40ba1e7b57ba2e79a7a1
SHA51269a089ede4a27745cda503dabdada98500a7a2648f847a178054fdbad48956e64475f8df568c8bcb86dacb0369fc608a3579b969f5a3596e5a60cacbb12e6f84
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB