Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 10:26
General
-
Target
3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe
-
Size
208KB
-
MD5
070e9c8cb132754c3ee88ce0ba149e1a
-
SHA1
ba97e75607f569a1454664bead3268946941d9b0
-
SHA256
3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72
-
SHA512
0d93de4a170b05e17efe8758122e700a130ebd3c915474f82d40cd1265a96e06af18985cb98cb6fffcdaa79d11dfe799a997b128d5079c648ace52c5a2977ae8
-
SSDEEP
6144:ka1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:kbapK0JCmRcU9vVokfj
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe"C:\Users\Admin\AppData\Local\Temp\3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
1KB
MD599ae471fe8a8115118695bf0c9aff3b0
SHA1cb539bfd14f4aa79641dd5b775cc0fafcc5981e4
SHA256aaa0bc2b81c4beb7929a472a35be222979fd3116d71399824d5b137829b64a6e
SHA5126b0c640b58c597f81b98d5c9a73b4851e5a861185f4a204269f0cedb85ec927173a048e9a1dbfd1ac7510f5677521dd525bd904c49598502d1d3f19581c59372
-
Filesize
24KB
MD59f602e13205d47cb18b10a910a4ab79e
SHA1e7f02f18f60ceb48349b35e60d2a008c311ad514
SHA2569da06161eef5b7d69fc0294df91c65ff1acaf6744dddd58493e47514c91fab79
SHA512f9001e75f8f8e6c9e0a7e8d117c60a1cdeed53b90d63ae2039df0ee9051a147ea12cc47256cbd98ac541e5648ae9e9d9badb75e832fb64c636a0206bd7ff9b0d
-
Filesize
61KB
MD5a35d262edeeece123540aab9c971f433
SHA14fc0807349d666347e3e94ba1e197815c3676137
SHA256c6d1931c4322f78b9ae52f8bf3d120bc19eefb8e9bed84f4697a9d0a755682f5
SHA5127b8fc5514473cd0ef8084fdebe7cef5b367ae531b59b9dfe73faf8ed9f8aac7aecf1cce1e5aed6bcdf680ff673e5bfffd7cb983343513d2d1892f76c695203bd
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
208KB
MD5ae5aafd21b567bda0b95cf149516d46d
SHA14206fed8d111dcc6020c902a4f5543053dc3235f
SHA2563005549ec5e02a1a1193c9f66637f257e217ca75988a4661b776b0f7406e1921
SHA5125b7a2da75a9c690b05cbce702549b2562990c127a23eae78dc679a4dbed233040a737570e146235e8e8469fefd9b49bf852a1a3bcb212d56d88f498b5f0566f6
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
728KB