Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 07:22
General
-
Target
490fce895ee8ecc733f52e80104d8164912ccb25c892ed2b61c42cb233f18c93.exe
-
Size
1.0MB
-
MD5
f860ac77a931eb351b3aae6d44c589d6
-
SHA1
4e9466907241bd5e081f1f3bf2d199f408940e6a
-
SHA256
490fce895ee8ecc733f52e80104d8164912ccb25c892ed2b61c42cb233f18c93
-
SHA512
666f6aac4b9234d6bb376bf99992175dd645583e55be3c1ceb2e13cfa5fc8026214eb853fb7cf80805545603f9c5c2de04b2bb4365657cf08c1298a09479f1f3
-
SSDEEP
24576:PmUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5emUNJyJqb1FcMap2ATT5k:PmV2ApemV2ApemV2Apk
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\490fce895ee8ecc733f52e80104d8164912ccb25c892ed2b61c42cb233f18c93.exe"C:\Users\Admin\AppData\Local\Temp\490fce895ee8ecc733f52e80104d8164912ccb25c892ed2b61c42cb233f18c93.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5faf66f563d2bb4db3b09f71c976f520e
SHA12625c8e10626c00fdeb2d8b5185dd02d67e0d644
SHA256fed971e8c473580a4da119912a0c38f3795402b56ca95ff2b1f2a3234cd2ae83
SHA5127edaf1109e0c20c33563556a1cbbc1c866ac81d44508acef6a8622895fc9969f400eb2b1b5460f02daa101594d82f8a3d08cc883ca2a8fa29b89e833bdf28cb8
-
Filesize
24KB
MD5b0361b21e1e85e4fac439f2d0be4c1d0
SHA13c76b067517a5873d0d6d22910c2f05dbbc19df6
SHA256610de05ef7378e93b4a20e6f907960bc832f2c04eca8d497d9d2f16086d4e16b
SHA512bfc08437b12bd4efce63f4ca7e6fe05d44e174041bfddeae99f39cb2e852761baf9f4db4898b4b885c59696f577ab5464e4a0ebe26bc3abab37b33b33ae5d8e3
-
Filesize
1.0MB
MD55133f4c37fc917c9859ec9bce1bccc70
SHA1633aa351a85daebf4d967a635063f12933e4a530
SHA256ee453385d0a89c07c6aecbc15cf3419afe165e51c0928e06e866233300a0b852
SHA51291eebe730776db3f6de7f8572954173cefe21b109056e5f2475a05309727fa57acdf608f1d9fe1949a7910bd7557839d3ba62e6138a9fc87318258ae0f620f31
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB