Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 02:37
General
-
Target
870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e.exe
-
Size
355KB
-
MD5
3f14f5f3463221269c23e37f50c8a2c4
-
SHA1
0408dc4449926a31e7fcc7b8f6c3b516f3bb61b4
-
SHA256
870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e
-
SHA512
5dd24520198b54ad8edb0a773117c1fb1619a2dd51e81572c37dbe53987200609fe9909ba80373710f4d12067e173488f07dc53fb4e4cdd7e5f5ef6bb7b8bd6b
-
SSDEEP
6144:MgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei3:OmWhND9yJz+b1FcMLmp2ATTSsd3
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e.exe"C:\Users\Admin\AppData\Local\Temp\870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD50dbb6c1eb0ae003ecb8aaeb88ce1997c
SHA16fd9eee52bacad0075f63f58bf89c03687d1e704
SHA256101fc102742905c5354b4c27d475e2e602f8b304e8c586d977a41169650d6e3c
SHA5129c0c3435cf70742c3ad371cc79f9e4c58448467b881c2cb881a20b7a001ddbfb5d23e67b6b2dc71d0f3db6f28ab08ae54106328d21ee954e6bec8371aa66614f
-
Filesize
1KB
MD52165edb10c3f4c202e07bedb53d7e67e
SHA1067795020a0e46bf2afde578a2bd96c93ba63639
SHA256bc0ccc5c288c0cd948ff8ef882e49e4393ad599e8a962b4e6aee4b55f42a04f3
SHA512c6450d9df5d163d20f94166605096e1a66cb5fe5946d88a79d3046ffe032e8970d6709881c733ad68eaa0417117fe3cc8b0699e42f93a9469540b980163102cd
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD53bc2c726f922a4ef46238f1926e9767a
SHA1e9ec66a1d5c9be355396b2c04099fc396b4c08c8
SHA25691b500151ef6a20c9348c1b7ad31052decbd79d4290d5549a00ad41399a5b6da
SHA512f330688636eafbf8507f3aefb3d8f3e6c81fc8b5de116b25651eef030a6b81f9f458c2cff6b5ec5dd5ac65ee734a28f10d2e1a658c4ac688f01410dda3cfe925
-
Filesize
42KB
MD5646807275e244bcee6525d6db0fb645f
SHA1665ea20b20ec165974de808a5ad1e8c34373d683
SHA2564bf12bb08c19e511ef79b573b62ba99df84cec367065b744540b816140ad3637
SHA5127619d2cccd49237a27ddda3d4d143795360c71e41c1b239c80ab704e0c9d7eeb20f3f8b7d3d4728a66cdee7a72e2c3a5fae8e65ed07e6d83139029b93edb6090
-
Filesize
42KB
MD51eaa69b66a35efa5cd21cf49eefcd6f1
SHA16ce7680364423b1406d6f51ae44597d926cb6868
SHA256747e2394911d16d6decc6346f17a6d131af48583928e3b44fd0a2f31132df6d9
SHA512e1e2992d55196443caf1a9abcbb771a73ec8e785f36300965a819dc1c2b74fcd2a505a3886f91753851643ed557c99ffc40fbb141494d06f560c9e090e4da673
-
Filesize
355KB
MD58cde02887949a35328a0fc65985c92ce
SHA1dd120876901aba523b9deabddbd7461b0b2e5e5c
SHA256738e572108f199ef37dc3b7c85d699e61a25b80e3f7a77477a018ed37a1209a0
SHA51295ae734c0a49bd308944ea89c55aa7d911013f9c1a66d59831a6d9803ecd05393d87aff3bdb3fc986746267fc58ad9f4806db9bb29f1901725731f5d7215f5d0
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB