Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01/01/2025, 21:36
General
-
Target
33956737c9ced09f9ea29672cd433cf6dcc242f8bfc89fb72474694d9f5e809c.exe
-
Size
217KB
-
MD5
2d6a4ff3c4b026cf68aafa5232e9b9e7
-
SHA1
d5998303cddc1aeef2741c563ea0ac0e1710cb2c
-
SHA256
33956737c9ced09f9ea29672cd433cf6dcc242f8bfc89fb72474694d9f5e809c
-
SHA512
c55b35790c1caa4e737a16082b44c24dbf2157cbf7b1d0b0dcb3a2254d68772570184f1880afdc0eb8534674944b72dcd4d5a2f87de7a2c21b849b5a9f960b9a
-
SSDEEP
6144:CrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:osTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33956737c9ced09f9ea29672cd433cf6dcc242f8bfc89fb72474694d9f5e809c.exe"C:\Users\Admin\AppData\Local\Temp\33956737c9ced09f9ea29672cd433cf6dcc242f8bfc89fb72474694d9f5e809c.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD59c00df0d6bf2d413288521ac31b8f8bb
SHA1a157a9b7e799b0ab87c2b1e64948a76138c32110
SHA2564e3c656ed30ad9707cecf5d7f44c91968df1bf960bb7bb56a493cd59cd27db15
SHA51210af4fd637840c5c43787636f6e01d7c182682ab460e81ec424ae777c2eb94f08e37873976e928af4c6acadccff3a926206ae03b8bd632f3d486efab77ec4ee4
-
Filesize
217KB
MD57764d19447abeb1fd6409efbb25ccc93
SHA18a7b83eb289e9343a569e7e4a9865ab11cc9bbcc
SHA25676a1ec1ee941e8c55d7e1534352945fb99735dd980b7b6abfc8d5d190b832191
SHA51271d1fb2317019ba9e5179b448121154e68fb270a61492103cc1b7ed76d2ad1fc2f91141a4a6b81e8c408554faffcb0141a786646969b8eab55b9bc434710814e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
1.5MB