Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 07:03
General
-
Target
7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4N.exe
-
Size
355KB
-
MD5
c2c4982c6a46e510263d27a14138b280
-
SHA1
c366cc475dc6865ddd34112cf8979a454cdb84db
-
SHA256
7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4
-
SHA512
af7cace069e784201d30f64810be9f0f959f3b831ef7aa18ed0a5d20b3b200492e0ff886ef174a6e3d2c4b8cd52b1bb223ef427531e3c80688378ce8b911e7c1
-
SSDEEP
6144:MgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei1:OmWhND9yJz+b1FcMLmp2ATTSsd1
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4N.exe"C:\Users\Admin\AppData\Local\Temp\7fa4ef06b8214db665837f44711c463c6951ae20322d1a3009ec6037bbe6eba4N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5ed34eb4e43d607456b5b994df2fe5915
SHA10275a3d718405f87cd37c1941271b2d8846c716e
SHA256864b3131e6b63208ac88ac5cf16fd9a20dc937ba7c2b7da5aa594f35dc0dfeca
SHA5123ed18c0511c4e29f53adae38afc663b36755d0a9427932b00e9a58f985d43b108c5b427d4d8816bd6dc164bbb9e93407d7d4a9da6c8d5e4b70167d694616ee09
-
Filesize
1KB
MD563c589b3d653d13a20e6714a6590100a
SHA128be3c04c1d87ca59cce9c97d5d9d8e7614cdc85
SHA256f49313be7b154463c67907dedaa313c80301fa8653e724ff51442c9d60022303
SHA5127473ad65a2b23b986466b23b6a169653990c45b0ea55e21c810948eb153f3d16603ee9d3675b3d80c7523330b76fc7790acf8316c5ad1dae9334aa4d9e14108a
-
Filesize
355KB
MD5899660e74e2f318006b8709d46bf6e1a
SHA1b499e11bb9c3fe742215f864c7a041d62fe7ba00
SHA256485f88944a4ccf402271a2b2e09eff1e9eee69d5d6ad7c00343b31a35d56d3f4
SHA512142c169dc69b2757753f5b313d9395064dea78c4b89ae57670325657c790c801642bd2c0ef6abd564bd7cbdb69ce2386b8f6b95df750f271d3c484167cfc4688
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB