Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17/12/2024, 19:16
General
-
Target
fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c.exe
-
Size
204KB
-
MD5
4c60d92c2c5b2293b1b4b746dabd6866
-
SHA1
0c45715bb04dae2ddc5ba3334f797cc6d8c5d761
-
SHA256
fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c
-
SHA512
ec6c9308e786264d959f3684444028b1fc956886369af3eccadfed356d1430aef3e1f2ec647b6df725a09be16a26dc3d0c86b651c48a52350fdf3b63a8d9589b
-
SSDEEP
3072:U5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:ULexkuRaX41xoyJV65gzyZko+uch
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c.exe"C:\Users\Admin\AppData\Local\Temp\fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5886fa3a152d872032bd5759a19ee54e4
SHA1c8e5b8f2dc89dfa5f0d9d7c9b301b48422313aad
SHA2563d685c7e80514bc94a42ee15641345edaafe0831317e05f81d458ec96053f3d1
SHA512997b408cf2237f65302a05a179d936023ffa2951f9a1dfb64559031847120271212bb37edc54c7219312961e07774907e814305edea520e11cf597f80727df90
-
Filesize
1KB
MD55e5d47b4183e6b5a135ead4beaaf7051
SHA13efcdb68d9d83afc05fc7c8072c3ac5a4d6f28cc
SHA256b2cfdd13c40645a1ed0bce28f3219d8a1e8a1592b74b65f7f040aa93c8d090dd
SHA5122e366aa45fd09cf917f53700023d351c1fad009cceca897158754498b69ddd2eae9eb7564dbb2ec1ce3380beb8f2e1a3a280d5f3727ed54256ad978f96a2c4e5
-
Filesize
204KB
MD59a907d8cdbf23de4c38d0ea57fdd8b02
SHA1f1801212519fd0fd965e0515ddfd54698f69b467
SHA256ae92ce234e9b5a3a42eeaee5463632bc218320fcd6d319de4f556caa03fac3c8
SHA512e7671313152b8b25c4c0e651c4ecd26c2c90ef61780793440b7ca6ecfe75c9eb9a15bcf04214df9ed8955dfdabed913ae7706cc8efd00e2d3df18ae98c56706b
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB