Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 00:52
General
-
Target
71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe
-
Size
208KB
-
MD5
bfba0821b087628fdb86cd1a779f98f0
-
SHA1
ae252e625987c7be3982a768060912bbcd34e695
-
SHA256
71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11c
-
SHA512
9621d508fee45525d07238725b440fd097ec851a7cd2c0e06efd5b50dfd03650a11ed03cda8933015662cdf9a43bbdb2fac7de178c0bb428a375aa2f18ba0aee
-
SSDEEP
6144:LOYX27lPBA3YDMw4lj6idlMlwl7/79C87:LwBAy0rlMI5
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe"C:\Users\Admin\AppData\Local\Temp\71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5e140efd5f8d38457f32c84123122b9be
SHA19e547603c9bd4d11486354609f235631303d7f7c
SHA256493ee501148bb773c95fee3d8f904c9e70c43f9fb75c418cc56a446654d455a2
SHA512efa692a00c8a6d48bd6685317acbfec032d0a20d9febddb34974aa203644d2327cb697c7ffc750e1c61867c43a00429b54affb9436d10fbf34b9b1008e858475
-
Filesize
1KB
MD5dc69b100f7f5313672bc594c3233bce2
SHA17e4282c1aeefe4c277a8d68f7c8484276a6ea91c
SHA256a724464a783a9b61a48fbeb6b1969de22fb99cadd921afeeb84c47a33eeb56eb
SHA51232e7980732770c0467ce326d6bec7f60363ddcb2251f31079d30254e12bc6ae22a9433814e71ff01e7ffd005df00167d34fa53149abc2056b4fed0b123cc7109
-
Filesize
208KB
MD5ecfd40da7b457e5d4794b4ebbee6f77e
SHA1e9d5cc17263aa2fbaf10da2aced3a2e2fa58c36e
SHA2562ffb7fc76837c5e0aece90b4e63c6adfee1ab6e36a761282fa20e360767f82a5
SHA5124178541cc5c258fa0fe069c5be025bb30d1c2a523091eeb8bbbe057caf64dcd59f8469ee147cf462a163472cf3f0fbb9eb7751b1591c97d19a0106c8a283b907
-
Filesize
796KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
796KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
672KB
-
Filesize
796KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB