Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 05:54
General
-
Target
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe
-
Size
218KB
-
MD5
69698cd366448a9e31fd6a68fb9b5d6a
-
SHA1
7592e9b47ac50d1ae40676150d630bde0657a9b8
-
SHA256
a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339
-
SHA512
cfbeb058340bf89755fb15e5e3a59b89394cd872c5f33cbe888b0dcc5b04b7d057cc7e81390d2decf1b10ce4651f9ea7a390136e23329e73109e0feddea010a6
-
SSDEEP
3072:Kvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:c1SyAJp6rjn1gOObn4b6h9R
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"C:\Users\Admin\AppData\Local\Temp\a92308d07e9cb0c6a2e7e0bb78a02dbc58f78e934f94466fce4352793f471339.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
1KB
MD5dac8c23a361d92c9cebba8fba774b1cf
SHA186490f231e1fc808a3a00f098932f6b31b8e568a
SHA25689130ca7e9ce93870500267f6ce382b8187055e07280d915bc2efc62f67b2646
SHA5129691d952906f753ca0bc0b30fff4828dfc3eb5647af23d1f2b2fd6835fbfd50e5ce0e30ce9150b67a8f60f3511b2e2b7b2756d5f5b2bd0323ca83ae6807c4d66
-
Filesize
61KB
MD5e758c12f0c43ab4d83b154e8cb3062c1
SHA1dabc6fadac21e4d9be44c5dbdcf7b64e0662ad0f
SHA256d7303fa46ccc0f62e99dbe46893c340cbec3d07525f8733f45ee901bdddb55fa
SHA51219ff6988059186bf4059c01ffa6da66a9e85e0d6d4fdba5793430abdb57a6c0ea3e4a23c9f9f29b7792108473c6df8a477f7a3a3a5193ce9198546bae2c0b2ca
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD58bcf3b15ab6353a47e0f87bfefeedf3f
SHA12706edc34971876525c35edf4cf3dd2046b2b661
SHA256ed0d25d2870931d9859e35684ad481581daae2af20c8ccbf7cc6f66e8f8295ef
SHA5127d2a412acb4dd3c0204fd2b786f06925256f3e9a330635c2e7471f004beb1699dbe1b4bd305c50bdc44d3c0c2f5861b842ee748683e00101f50fc2bfa9feeb23
-
Filesize
42KB
MD55532a8b09b327cb15764852eb0c33a42
SHA17d0d94a65110ffddb9080c5b9310969dad74c651
SHA2565a60ac66567b83780f016dc30bfdcc81a641a83a049c8ee8de1eae60ac892b29
SHA5121a1262d541e7dbc4e98abd0b0dfda411c64ac45c0b1baf65fb9af4929e8546caaf66570d961fb4931949e02978d74b0dccd111c01feef5032974d36b99d6c8eb
-
Filesize
42KB
MD5cc57844a1a2b7f8d93f11203d15027c9
SHA14d7c15f7add82c849c10521224f4705e25a3d190
SHA2565e3186b4f1b6eb5c96da8e46b0fc16ae318fe40b6763a7cc64de180860a7d9c4
SHA512fe3eed55b9fcf6d31d80489c3cd49384176ba0d595d5c7d7a40887f5115b3765683941a39f2f6dba699a2ffa28ebc9f5ae3f7a5a89874781364b2f7faa524191
-
Filesize
1KB
MD5a26d099678e879249bc721ee68ad586d
SHA1a2b98e4e215d376a1f2ce9a17ac65d8b949ecd94
SHA25674c5863a9c59937f7ce1f9cb346149f5dba98f5df390ccfa3fcd694182d076e7
SHA512bf02e83c3aae2966020ae79e5b6f5f27cb296ef8445e1f87ff55c51d0b81bcebd74ad8bd8194c4ee9c062d17a4ba115269a9e5032390c14bd9a21faacbdb85a0
-
Filesize
218KB
MD56f73910f17d95c100fe658f63dcb6357
SHA175efb2a2c9a1a4b0d90731706fdaba8e82c15d71
SHA256a7e2e2a2c4121002cef20f0129a592c84615dc2d9b8566913e5ede10d9c0a723
SHA512dd19605597aa6e7deaf24ddf259b15b35048d9e2a11a40eb96803ba2e0172e3957645187509fcf28333efb753896bd545c1867034d0114f9d04d6195653a23bb
-
Filesize
324KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB