Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/12/2024, 03:08
General
-
Target
c088055d3c4719c62f6912d0087c71e49c9b94b3a6fc48efa425313cabc995ba.exe
-
Size
218KB
-
MD5
49e4d7d768cb4851b1b417819eb8f83f
-
SHA1
72a7df610245cc27dc210c69b23a2f47d2966358
-
SHA256
c088055d3c4719c62f6912d0087c71e49c9b94b3a6fc48efa425313cabc995ba
-
SHA512
985edf65c35d9c249dadec7da2e36d262e18aecf2af208500de27a137388dcf02be53b24eecaee58a69c7f9fba369fbf9b55550f6b8e3feb251ca692e8bd640a
-
SSDEEP
6144:pEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:pEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c088055d3c4719c62f6912d0087c71e49c9b94b3a6fc48efa425313cabc995ba.exe"C:\Users\Admin\AppData\Local\Temp\c088055d3c4719c62f6912d0087c71e49c9b94b3a6fc48efa425313cabc995ba.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD572d7ef3eac306977789870faef745912
SHA17b6afaa438b6d136ebfd5939470eaa351e2f00cf
SHA256b23eb32159b9df6f5bc6bb74aff8f62cd05a2cecd373473a2c1039653e14310b
SHA5129d5aee23b6d27c5a5dc3cea6ac9a75894b0b2f9d51e06ab7f719d61e423c3a1130901d38670316a5f0ffccf05cf12d529ba12be9fbd5f8c9dab10c9554f75e4a
-
Filesize
218KB
MD596a385b5ca7147eb8916f18290d1557d
SHA16fa6470c0f918b1eacc64ea0152074197a91f975
SHA256f3a75a7b0b2fdeeb027bf40c6d662c942dd91b87f08dbb38ccb643f6cbd93d15
SHA51203c1d82173ac86f627c8a9a1793b1b935663d5ac2cff60f73b440f934f1f2a5b1bf2f3147a8d06c5c33957af753b235e96440bcfd615a04049796dd76ad86d95
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB