Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 23:27
General
-
Target
0caf1643f0a0ee695a6c0838cda6c2df1f16bfd667f4807f65b3d06528e846edN.exe
-
Size
375KB
-
MD5
d30b206ff91df23e77689f247b913eb0
-
SHA1
5be1862f99aa95fbd1d5100883c58c8ffaf9e71a
-
SHA256
0caf1643f0a0ee695a6c0838cda6c2df1f16bfd667f4807f65b3d06528e846ed
-
SHA512
d1f5472c13a11c7f8e8dd31c0220b2125668a55f72fe5de8a6c4f088f4261e84590078dd1c14970492bb29f66c76191899cd54bef4dc97f82036af67b0e8c0ed
-
SSDEEP
6144:s3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:nmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0caf1643f0a0ee695a6c0838cda6c2df1f16bfd667f4807f65b3d06528e846edN.exe"C:\Users\Admin\AppData\Local\Temp\0caf1643f0a0ee695a6c0838cda6c2df1f16bfd667f4807f65b3d06528e846edN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD54262a6d46a19bebe524d9cef3c212788
SHA11107bee535cb2ab4c15f7f76f02966eaf85ea00a
SHA25638d145f63b161342e7a07dbdc4dd26a0d0bf595ec403d86ab40ca2421e73e644
SHA5124459081950a7d369393bad826110bb5845076e15eaabe016a70236af26f32786744f60b276a7edc4ad29655ea22ba7d55229ae8f27c9df9158f6ab80136e6235
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5278dd5a97f2568a5d308a4b8b2f7c2c5
SHA10ed9b121484c11b11c6e50c98c284b1159ccf82b
SHA25647b61448d781ab4691a3dfd11b57eae9921042de69c0779e8efff1d1cd4c5437
SHA5124851784ab0309b65a01aa44b486b0695ff4b8ace44c36cafa251bfc39316ce89205494b6aee98e1a48f72eb7ed4bdff7b5e3ea0e6e7be56f98e995988a5b39e4
-
Filesize
1KB
MD54865faad2248a8eeb86ea6d3af60c90a
SHA1e2a593e20c007b8672d2e64d33ab41acc68db241
SHA25600630100a9ad2df012a5bafe959856f625de2da8021968835b915f1894654686
SHA51277886b8806d8c51729c9ad85d367284f68ab1f1ee2bf6eabc5feda9104ec4f183ac1bcd20032e77ad84b134654826999994a9fbfff0575100b69b05ba731d142
-
Filesize
24KB
MD5bb129bdf727c0e817705133e74e7d5a5
SHA193cdaa32b8e46e99c9cae8d7eaa5179faee313a0
SHA256fe78c26672eaa398fd81ef3b0d638e26fc92320c90653cd34f3e1321d019a02c
SHA512523ce2e7e30ac52ca4ad55bdb087731128bea3ba2067586aaec4f512b8ed58f0c3c5dd1c2bb179bf22a72c0887cdb71fa3ef5ab9cb970ef92ea5d8ab2104a042
-
Filesize
375KB
MD5655a7de78b6667374f2e1ef909e4a96e
SHA1ef154f83bc3baa34a747e1bc7458498c08fc8ad6
SHA2563fec745edae88d58cac11e0b6ea327ee7c5328b558e71baeb614ca1abf58c6e9
SHA51290032f9caac235a2347447d4f29d69320fb5a9aeaf3b82d67d18fc2b3cee40d272b3279ce14a73166cafb0a149d57cf238668632b228210ae87e4f375d3baffc
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB