Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 04:25
General
-
Target
54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd.exe
-
Size
218KB
-
MD5
59b7bee08b93fc653dd5ca7b97f5dcb6
-
SHA1
b19654c8d982fffc994bfc9ca69a958e20e0e577
-
SHA256
54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd
-
SHA512
5ffbf6bb29c6d4d532ec4ad7c854426023f45be703bb817119c5345a3bde0be2aca2d3c22ffc2ed0f273cb5f5731de76174020aeeb58e372660197df84ce96da
-
SSDEEP
6144:YEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICy:YEGDdQNHEwWlMxYG/wIz
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd.exe"C:\Users\Admin\AppData\Local\Temp\54a3e93fba62daa15b0a3b937da2ce853ecab8e5b863c6f5818b3dbaf2fae0fd.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5c40eb24c0a2c5d6e45e4ed909c54e4c1
SHA12693f061dc01ad2df3132f5a6199d78e005ef0fd
SHA256b66f12afd4fd5c158c5b9fd5daed80a91970ff78abaa2438f6c06e528dbb6e3d
SHA51261f85b61ab8bcc221264ebb96b8c35cae9485261a61b71c42e564984d4eaa2c4e1431d2d5a44836067c1c849fa3f4b4a96e409ea623f4084870b2e690d619fb0
-
Filesize
1KB
MD5a07d9ec9ec87bdea988616361fa9ccb2
SHA1a22a4a93f6d2110cc519728da3ccb4f119aa7e11
SHA2560b2ff7d5680b194ee243859bbfbac19eb27683a9ae0909f59c1a3a7fa6808aca
SHA512d5e741f251e2f85eaeea921f64244d4a027e6e4c27f8eaecface3d5288e9760626a7292d179af1a1fe3ace8e3d79e181bc1a8e0456c9012e083f4e4d6215d028
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5be65cd95df0bd3f4725ebcb657d42d05
SHA10b91c4563d409d717f033b42d2cde27a39b3d204
SHA256736b9e0f8564a3dba6188997a5621020f5c5908bac9d42612bfa1c3f81262c75
SHA5127f4b6301898b4df42094ef337c8f48e3f70adca37f850afe81757b3c96942c2bec56141d79459115a9d733541ef579171571f9c3361e1b2386b7f936c55504f0
-
Filesize
42KB
MD5aaedb858bef18aefc0c853b620c808ca
SHA17cdb88ca9628402e0ed2324cff0add42ceee2d0b
SHA25698eee20c7141210ccb221d1a7dc6d6fe61ae783eb1a593b027bd3404ef185ef8
SHA5122d3999387532c840efe34f3d6094278dabf0950a5b550375780675dd31aef7a946e84182b42c7af96209d5a55b81d5be6c83cff663119654fee566332d1bcfa0
-
Filesize
218KB
MD53d4783d8be7a97db9a5c0f910665e245
SHA13c1a40329058d26fb08a7e6aaf038b2b51fbdd17
SHA25637bb31215f1cf02094e46418fa306f72c28671d47e9f317d01e250c29c6f1349
SHA512087efec81ca28c03490943336d7795fd8cca58bfa29cd36f510d9ff6c62c2d67d592d9136800d0de7370a42878190d6aa1db62569dac22c1753eb2e91aa460f9
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB