Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/12/2024, 13:33
General
-
Target
8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe
-
Size
204KB
-
MD5
5787cc3375ddab36955c3ccebc3ba670
-
SHA1
1e9bcc8297b3df71f3cfe82fa4fb62bf60019f8c
-
SHA256
8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58
-
SHA512
6ba4331da1d33babbcf688073a0736756b1e346b8711e518640ccb0d82b0e12296e77986de8e103c57b8171ee178c9244b6f243ac496870c649ade8804cf2354
-
SSDEEP
3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:mLexkuRaX41xoyJV65gzyZko+uc
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe"C:\Users\Admin\AppData\Local\Temp\8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD50a02f4a76260c95a2f76001f409a182b
SHA176f7efd6eb37cbb4ecee5617b1c58580fd7c5b89
SHA256fc4ed8660243972b3f28f35ab372a12659a5fe91c96e3921442c56277c4a4780
SHA512f527a785b343adb4cfe7fbfa9bcada4599c3bb2db9d24ebedd32b0edfaa3986e11f72156ee8859c92ae7e966578db07cb2dc1a661d911770d13456ff21b98a29
-
Filesize
1KB
MD56e605d80820349017af9299a33a6a769
SHA11c45fb83f4e8f53efad0a33f9d5803a3670c139c
SHA256575b1b0863c04e3aea349d0ad5630bbfd0a24dd9f44d83b7843571a0403241ea
SHA51297b3b1a324deac60b47f5aaedde356dff61281b9eb210e23563321bd4bda9cdb6d6d779e3b33d510c38a9f50be1554ecf17ed043415de538653cd50569ea8168
-
Filesize
204KB
MD5f0bbbf1dac55cb1a0160177cb75f15b6
SHA1c0e5423b73486e550c0bd6ce9618387275546939
SHA25602200670da2065fc778aa988650a17d47c6e3e47ae00230eef07aa7b68ddbdab
SHA512a45e45a265bc141fce40b956d7dbee5b73d593cb48ae0127d1af89e3ec69dc75eb0cbbb98159e1ffaf3868fabbc7d52bc0296f3c0fba02b243b65610083733d8
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB