Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 02:56
General
-
Target
2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679.exe
-
Size
375KB
-
MD5
96511d1683e132d176807e03bbd7dea8
-
SHA1
5e55eddb19a0eb2791cdc20c4867130f081ba12c
-
SHA256
2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679
-
SHA512
9654d496ae1b5040f40639f1821abe18afde6d988e3855172c1fa76f5194d98044dcaa7c3adf2650dd5129e1fe6d5f24fb88344af85b19a469e57421fd91275f
-
SSDEEP
6144:z3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:AmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679.exe"C:\Users\Admin\AppData\Local\Temp\2e17c1d92c927ebad7c7e1cef2353ef6d6e02a7d235b6aa884e3f42f0088d679.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD564e4d1f7c04e1feb8aa19654f2aa2845
SHA18442c8302ded015b683d243c87f3a87080d75283
SHA256d74d1a5a9789f0597f779d49284c074a84097def15941d1d11071a31600e1e3a
SHA512b3177fb5c09af9ccc51760ecb9c99185892e74ae5a881f62edbacb71343fbd5fda7a0e66acd94a70433c7e5d278ed6d45dfe2d554285d58be24f192de77d03a6
-
Filesize
24KB
MD5581e6e45cbd5a50186956f30bad55ca4
SHA1f296c38d2a08788bf643a623811773e13e402fea
SHA25662369e8941d8fe3930df8712b1d4681df4c9b38aca6e685df917c70d95ec33c9
SHA5128fbdf8e515c291ca6dc45c91116097592c4c95caf99406ada84cfef4cadb4976b9d76e5dc46c75d060111ea08cc64477116d09d3bfe596617ade7218827853d4
-
Filesize
41KB
MD56bee2aff60c179acffe8646332aa8bc2
SHA15ba55359485ae73e18c50672d7dbed86f8c67d5f
SHA2563996741007b5250c214b5365384e76787f976881032050c28e6f1e17d41d9790
SHA512ea2e39ef0127d4695ae48f848fcdc7c75bf9c21b45c7c4d5931a6613bb6f817b78cc1a6a817f396aa1bd4158b63670d6ee1f7e7c95f037d383b412ef90f3b981
-
Filesize
41KB
MD51e00b7efb2219524ef2c28ad37efc7fd
SHA1b01b38d142bc8685db0e23435fccf12270a20c4f
SHA256cd4e060b10838a5f0118b59e12ab8d326cf305e0d74d5429bb989edb46a0eb5a
SHA51257e4e4d0e8445eea6f0e3dee329f53069a028b28433f7ebcd6128bdbc8f1647e7534ce50e5be17759039119e879e49c9d7f88f0ec944987e8d0bca010a9dc53b
-
Filesize
61KB
MD5216764310ad3d7dd4d5572b54c60279f
SHA1b5333166527b4cf77aa39ae4a4062f23f0354c62
SHA256f6d410cc7f73ad0b51ca302a88830366f0058237682b01babf0bf430c9fe83aa
SHA51269b0d6c3e073344988f7f51eda35cb7efb898ff1b7130a63017d792a542b2d0fc42b8573795d8c61f066bbf65742c6b78e2602d797bcc27cf3de443b530be3b1
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
375KB
MD56f770416e605cd1ac3b820efe1b06596
SHA1f9e920e54582f8081030c0a68bcf700e8230072f
SHA2562dc1e3b0f71bbb988a3eb6c8200234420f7f3e49bf5388506aaa5475c300e859
SHA512d598b181ad2d38d4a08cf6a44d015c9e4de2bab0fa546349a62182cca9df58a62442dee6c90d032ef770aa13813630991fc1be348a0c1370cb6fa10f265d2dc9
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB