Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 03:33
General
-
Target
4fcaa10f8da9c43bc7d8eba80d02919d6b1d70a3d68726ec789d181530fc0a35.exe
-
Size
218KB
-
MD5
3039c3ec8a1ac3119bd4c0e09d2f069e
-
SHA1
e148fee0f9fd40e42421d583a78c81d51da775b0
-
SHA256
4fcaa10f8da9c43bc7d8eba80d02919d6b1d70a3d68726ec789d181530fc0a35
-
SHA512
ab4f250d972bae8b840be6340c438f08bf95b31dcc6f173a3edd2b4b3f722ea892cd41a3e4f7174c15336353cad33d167325008ad32fe9cf56142ecada921ca4
-
SSDEEP
3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:R1SyAJp6rjn1gOObn4b6h9B
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fcaa10f8da9c43bc7d8eba80d02919d6b1d70a3d68726ec789d181530fc0a35.exe"C:\Users\Admin\AppData\Local\Temp\4fcaa10f8da9c43bc7d8eba80d02919d6b1d70a3d68726ec789d181530fc0a35.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD570da90986fea9e2d68ef7fff27d843a4
SHA188a4dd455de633d440c0609793a7a0708511ac89
SHA256b18b2dc286c98752563eb7242cfd474ea2c9c910b5681612ca5c25560d1a1cb8
SHA512a59d5aaef081bef6059b24a48208feec97be86bf8b290258f86ce23b7b06aa0de0f0e7b94502080595b1dd4912e26cf52e61c35a8f650efd5be0a15e438ea96c
-
Filesize
1KB
MD58f71234f6b06a18a80bb0bda2654b46d
SHA1afdb4599bdc1b3c9c604ccb67057cc3459b16201
SHA2566207db515bc9406df74b82b6906efee04a44cc8a4eadc29e371fe8e0fdd9024e
SHA5126e093d0fc58b1f38d1d623e0d2ade18092faf2749cfe268c230b53cb2255d1a550abb5256af22dcf0ddf769aaa77a4f899434eb756d86e70ef2d46057b4c565a
-
Filesize
218KB
MD51e94d33b7682506056bbfa7a82a280f3
SHA145e5b083df0e91a902fda131fb800dce23e78b5a
SHA2568f8f3a66c9c7aaf23fd402d27cd3c4a0f9ce5dae9e37a9a575d839efce7ddfbb
SHA5122305b3b91b5c6dcc0d239e8cea65d824f1aa83867e48ab9596cd335ae211e0f44ae7b7e97f4ff198a712b538385a5d11e84976e936ad3d5bf87c0b24929772d2
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB