Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 05:37
General
-
Target
e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571N.exe
-
Size
218KB
-
MD5
b882296a2a1886702975320efd254ae0
-
SHA1
9dca5a628225cf93cdef7a84f07dba9455769789
-
SHA256
e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571
-
SHA512
c83315c56bc87d6f8d512cf055aaa04e74d707e36ad9e060515a80ff6b81a85b3dbf7442a062b195b7e9379b8dbb1bb65426a20febbf1025429ef456ac1337e8
-
SSDEEP
6144:mEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:mEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571N.exe"C:\Users\Admin\AppData\Local\Temp\e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
61KB
MD5bc67e78d7cebea9f5f15a407aaaa1aea
SHA1dd18a282ea6b7d97163dbccfee3492c0a59bb6c7
SHA2560d54580902ab554239a838fc1bfc2caf697ca1259a6bdd6fa1eb49dc6a5d0938
SHA512e3253c628f3bb4da7b137303052b9c44033d9d84b363a97400f1610b9583982e74780717dda279195cab6515e0957c69125dc6dccacfe763d3255f8c11594981
-
Filesize
2KB
MD5a5fc1256900b3ce0f93f4928f795e2d0
SHA10691908b5dc8c97a78cab89946a6fea955df6360
SHA256428d288609c88876d8daf6d675fa04dda494d577dab34f89984376504020a902
SHA512c0221731d4c94d8263c9029d48a66a978ed37aac11c1778c4d9a1cad5b4dc65237eadb4a993ad67191debab2204843a719dd42386e2a52b053835c34a220afbd
-
Filesize
1KB
MD54d3352eeb09f1916c769a98a52c03530
SHA1bcb855ba127595b540d0a16b94fe95f4e29b5633
SHA2560ff8327983194e8f9c4b176a5af587ed4ae09045ee0572fb1f44b1486324cb9b
SHA512f24fe7be377c18a53af13c3c6f69cf534d63f4747581a0c698188df1dea3211f5386a3dc6ab00e08e47b880372bbda3ceab8711c760ea1a481fefd2f5c595b5d
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
218KB
MD5675a787a58b97620a2cc0a9a16944183
SHA1380660938724cb52cd08f4c23d7bf44054347b26
SHA256354632fff0479b51587fa958634f8c15c4e0dad8851541df92b64a35c76a360a
SHA5129747b21b4ff68641361745bbdcb21c8377ac8305753e3e85d38be967d519c26b8ce2be1de2a686546ad4c952ce51d13465115c8fe79b7468d8f9292d45217a09
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB