Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 04:46
General
-
Target
c8bdc4200c515e0d4faf368abd8596c5ff3206ddda8a72c57383a518858e9edfN.exe
-
Size
217KB
-
MD5
53f5de90c854efd0eb5bcf07d20d60c0
-
SHA1
a8ad649f0e46eec9dbcfb9fbf2aa6244919c35a6
-
SHA256
c8bdc4200c515e0d4faf368abd8596c5ff3206ddda8a72c57383a518858e9edf
-
SHA512
baba1b8e6ab1ff3425780f95aaa6c00e821fdc6212b70b1882253e832cdbbb5ac6acf3492ea4d8ad30b27ea947614a720c972865af4946466a30bfc5b21cf292
-
SSDEEP
6144:NrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:9sTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8bdc4200c515e0d4faf368abd8596c5ff3206ddda8a72c57383a518858e9edfN.exe"C:\Users\Admin\AppData\Local\Temp\c8bdc4200c515e0d4faf368abd8596c5ff3206ddda8a72c57383a518858e9edfN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
61KB
MD52f75dc3b3ff5241f3394835ef9277880
SHA1e74c7236ea9c2a8296e6a5fa2ffaaf0c38e637ec
SHA256c36528e29fe5804a24c61bb562f2ac750dc25c9011f193c304b7a72eeaeae609
SHA512860d3c3d03cf43918b64603382f2b1ab726fa61847bad2de7ef04671eab76f5d88b6131d7c6c1431f17952fe50921755dfd13be1c64c75b69fb69aaf3690bf36
-
Filesize
42KB
MD52d60614682efcd1d1ddd10ea3274f39a
SHA1a853e5c50a0d3d6f929a5993963dcdcaafe7e6b7
SHA2561f5378ab7728f8c357e5adf4f7ed9ea6e739c1d061c311b8bc523d6105fe0005
SHA512ee727786a03baa47526e03ce29731bf02ce14387feadc49bb79cf8159c21350f4f95ca7ff5fc0bd9ce5f71bdfd078992f3709a0343eb016e6ecaa5688226382e
-
Filesize
1KB
MD5eea765504a748aa8cd78e35701a46b62
SHA10d6eedf8d00903e0815c2951bdd19538e033fead
SHA256bd2348427fa51ef6c84432a1aaca7c22ce985000788031983da42f35ce96f0ed
SHA512ef689d14d948074a218949f4c2dd78d5f468ff01f1ee5056efbf8533bfde824d24486a2b77ec7c329c448795b64dd5d96d5bea5051e4b3b34413e5bab65a9d87
-
Filesize
24KB
MD564cf148875d928dbbe934801902fad0a
SHA159660631870f0d95b4b210e15b500a7c7f815e76
SHA256bb9be19b45d7885ea07c62422a37b6dd6635aa48420bb1b455c711be4c2767a6
SHA51201fedb9a53de4c668eda3d2808aed5145703e667004718f31802d222689e95edabc6b7457a3bed9f319dbd562f8f31b1ec3626277111a217371bd497bee331ed
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
217KB
MD530d1d9f2ecf45413853eb98c6d4d7cb2
SHA12dc6027c61211e62cbb17b5b40b484be244cf1a9
SHA2567342a924ab78ced68a2bda4d14f0903c7b4ed39092ecdc8ea05ad0a2aaa739e0
SHA512c2cfe6169cebdcb064640337704762c9e3dbd651bc57133ba501de5aa4d0d87bce9ef39a2aee2fd3c2e712b31dbb8106f2c20657b4842d605de11847c977353f
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB