Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 03:01
General
-
Target
3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6N.exe
-
Size
375KB
-
MD5
9816fb0d328251b476f467a22a1b32a0
-
SHA1
25d032c3bd8e1987e2e052b45cd91cb072c1f019
-
SHA256
3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6
-
SHA512
d4c276a666b7959d3844cc9f05e58e99e045c14d78ff8bbf1a63a15fd7ba080e472b5d4dc2a00cc22a8c4722c6df5e48ca84dfc2f2d8c5827c8c6df4c70bca77
-
SSDEEP
6144:R3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:WmWhND9yJz+b1FcMLmp2ATTSsdU
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6N.exe"C:\Users\Admin\AppData\Local\Temp\3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ee4f9eddbd7ac294cf509d59d179b853
SHA12c939fbd48970bc71fb02995ccd68fd4a4a80945
SHA2560a535efb31b7a8bcad26cf0584a29c4d223bc16bc0a654734f2e6d8143535dd1
SHA512adb8a7972141d43f243ed2e801d7f38dec0a9ff2b2ebf4e28319ba2b4acc91f12f5b1212d4753ae335d566684d7b7f55086487aad967a173768f58eb2b4528ee
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD5c938f856d787eb3ca9ce1aabf5295ab9
SHA1b4bbee3bc483fb6a90799c49e3e55a7fbc9e37c0
SHA256a10b94891bf653af623c6b20ffd3eff698a6f8965cb77fb20456b884670f0188
SHA5121bfc1f1ff7289a6345184d65c80d503cb47c04196714a2c8cff37bc07f4e5b2e7413fa6e140919f132f372892181eb94a35edbccc3e24c3ad0035c366189e5b2
-
Filesize
61KB
MD5abe17504331970f8825b181a50cbb770
SHA13db51c80f608ce9ab24b8cfee4b73b801c2f99da
SHA2562229ef1de246d793411e5af0cc440990c623d6a1c3e87e4cbe3d7885470cd2aa
SHA51282b6c49793bbffc5fc1665d70204ba678e6c1f33077c79fa3042b572e22687e8155a4b5cf39f576f98bfa2cb56ca8374644055b03750913d30bb9cc80d3387cd
-
Filesize
42KB
MD58d2b72d48de4a91ea681038a91a56c53
SHA1b072cd9ca058072f3a3aedc951af4911edc1ae2c
SHA256b93ca7b017182128ff5fc667662e6b4bbc407ca96c8223fd5033e4021be4cc51
SHA5127376a8456f0f4dffc9efe00e1295ca6206c030f3fe91321b950e0aacff8dde6bd478ae2edf624737bfc3b72fad008b08d3dd560cdf5e16e3b8a8dcfc0c1bfe91
-
Filesize
42KB
MD51278aec10cd3964c906c7fe7c0276963
SHA14c761587ea5b6a213574e2630cdbce5c3555e4ac
SHA2565f847bf710aaf23fa5a357d3a64f1f7d2719f329dcaab052767463036b4b647a
SHA51256b576b8ef3c367aa21cec589cedc2ea5369767e8967a0d37487b97a141526d56c1e796d555dcec1725b8064dac01b813509b54a32a53466e56cabffb0bc7417
-
Filesize
375KB
MD5ac3f123a88253b0138fe719f02ad25ca
SHA1ee73d9f9887a834f321001c34a421c797fcec6ac
SHA256690bffcd5c09261a3ccd268599cf8c605a38a3dfb157869126748cbf30630c0b
SHA5126bcab28b199a93a1a8d0ec059eb3d4b978b160630957a2aabdba3eede6834e7c10f8aa93606a39a71f9b5f4c7cb6913d2ca8d0d19f836a06e281365879e2c0da
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
400KB
-
Filesize
728KB
-
Filesize
400KB
-
Filesize
400KB