Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 07:00
General
-
Target
ec9cb69e3e2fc14486953cc12f5a1bba5f013371ebaff2636e9ee872daf95767.exe
-
Size
218KB
-
MD5
c256173d8e5d72fdbd013702d022938b
-
SHA1
9b7b7ea570796e2745024486b8ca6f5f531215ad
-
SHA256
ec9cb69e3e2fc14486953cc12f5a1bba5f013371ebaff2636e9ee872daf95767
-
SHA512
06f31077bcf66c1e0cdfc9b7fca424d6262ecc149ff468289959ed5aa2bfd5b315080609963bd3aef36995f8b5ca3d127954978aa1cf002c29dd361ec3b8d63a
-
SSDEEP
6144:mEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICi:mEGDdQNHEwWlMxYG/wI7
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec9cb69e3e2fc14486953cc12f5a1bba5f013371ebaff2636e9ee872daf95767.exe"C:\Users\Admin\AppData\Local\Temp\ec9cb69e3e2fc14486953cc12f5a1bba5f013371ebaff2636e9ee872daf95767.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD50ffa59c46e7e015b7efb0c28994473d2
SHA114c8cbb2a1babb029db9ca3888900481369ae61a
SHA256f4fc644585cfe8aceeb54637db8c43976bc3542978cfb0a94f44d10eef590630
SHA51252b0311a5638b878efaf4ce2ee1a2c295bd16cf4975bb5f157939952238e5defc572fc8a781ee255068fb09d0d57c475153a66cdbaf668cff8e4b64c262e8ace
-
Filesize
218KB
MD502d8ff708e141c979dc0ca653553a75c
SHA1f39c0bf001c7a41411fc4c44238d517d7c24bbc1
SHA256ae092b16ad4bd12f08acf07e3ef1f6160d6c91ff946ed8dc1657d11355f964fd
SHA5122c9dd4015c5c1834d23d080b23f08d22bf0f103bf0984a7f674d0a1a206a956892902fe7228e9d337b12c35530f4877034cb4e60b5c1e06bce1e324abbe70d34
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
2.8MB