Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25/12/2024, 17:52
General
-
Target
8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486N.exe
-
Size
206KB
-
MD5
6bd1ad2ff10fea4b9393f42f8b9632e0
-
SHA1
4962eac58fac1b51d28973bf57c8cce4ff49c765
-
SHA256
8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486
-
SHA512
bca3b834cfbf5f0901fa6a25781b5dd7a5c17505162d647ccd43fa853dadf048254ddc89629f126243bd87d82c03e6a4acf23aa1fb9f9efe0ed06abc05c5c009
-
SSDEEP
6144:k+EqFQ9A9ty5bhJcrs0MurPw/c4hd/B/coyXT3nOGX6T+:k+U9qyFhJy56d/eoyXjn9W+
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 10 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486N.exe"C:\Users\Admin\AppData\Local\Temp\8163790da9d88d1ed171c2329f1d708f510943e56e7772b7571db7242e72d486N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5f3cb1816f1e3d3b487c9589133d31a5d
SHA163ec5301e00a760169ed0cf927ed308e38562c94
SHA256bcb1b16c203b9726ff5fc1360cbd6dbd690f2f0cc521d70dbdac22e9abe00892
SHA512899034d607726a86964ca866ef8e6407e30f20dba7e7d415e717f28825390b7786da8e4a24e1967c716fffb1aefe8a127100ee6a8745cb34c29c3fc7a2484674
-
Filesize
596KB
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
680KB
-
Filesize
596KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB