Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06/12/2024, 08:33
General
-
Target
e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe
-
Size
355KB
-
MD5
d5ad61b8ab1703ab66bb8452c961739f
-
SHA1
c8e516fcce38bd7390ab9c4b8c424c9a6ce99321
-
SHA256
e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5
-
SHA512
aca99fe4de04220de4495921608d5e2832060175c7c17c688e4f93f8f1f4e07dd9b7564545d2a195a9650b3db774de4a624e6c6ea0fac8ecb9b069f601c59286
-
SSDEEP
6144:83EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Eiy:3mWhND9yJz+b1FcMLmp2ATTSsdy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe"C:\Users\Admin\AppData\Local\Temp\e3eff21453db9a295af27fb755d175a444ed83793bb98c5d98b61fd947eba6f5.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD52adaf5abb923ceaa3e26b59597457112
SHA1470f3da748b7e5ec25ab950166efcc50b845a7dd
SHA2565a7e05c4ce9251b486cf81088effa996f7311039543da3ce14bf470c6920a1bc
SHA51204a9643c7e02b4559b9f92b9a1a26059ae58692989e5b1e23f7df39688d3ed82305c04e87aedabb45c409affbb0a8ca5b66c3fc6cbfe5513e0ec8dddb4aa7f58
-
Filesize
355KB
MD51763aa3517439d3f540626b0a45d65b7
SHA1ccd05be8ddfc520dba938394b05710abc092860e
SHA256c2e32d62c364549b827c826cbaec5d80d93292fa5f6f3634da61967b5a5effcc
SHA512552afdef59d8b6e7fbe97bfd3a4ae35fcd23b318a5424b6aa622044afb039a147c7514dad7ea46177fa9adab3a3c85dbe0324d7d9850d40661f0d5492aa378bc
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB