Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/01/2025, 06:17
General
-
Target
63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010N.exe
-
Size
218KB
-
MD5
3a221330e2c1cd69c3e5da9815afbba0
-
SHA1
13a465a1a870160a442d6d7dd1b29f0ac96ebef4
-
SHA256
63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010
-
SHA512
f20ccd602e452b1a63965fa267d5d0068cb35755b5008e7e3c6c6d6b49125ba224b7fa626f63c002b215bae8d773d04d947a9407fef5f13ee79231d433ff5deb
-
SSDEEP
3072:3vm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Ha:/1SyAJp6rjn1gOObn4b6h9x
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010N.exe"C:\Users\Admin\AppData\Local\Temp\63c30940b223e71b78e426ee15969deb61006de6e73495751a763aac86cf9010N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD50348ce316f9e0538553a85d1d0361d48
SHA1df394a2200c6393266636d82bef134e9229dcd4b
SHA25671b820b8afe9ce9dc1583d66ff8e0335bfbecca0dfadc3a87275f97b6bb7a903
SHA512dc655b40ee701b76a57b67830093bc75083f0921b7e1307feb02c74d4a042219ac3b78eae543c29d75747da256c9a737aae7a89fab3f6b198e8d7b4fd515d115
-
Filesize
218KB
MD5ab750bc586091b5fac9f50f42ce824a2
SHA1a6e8d7acfd4802b5393cee6fe4198b1513f6cfc7
SHA2569984c8c398ddd40180e86b33f56528efead80c6ba5813728092564844ee46cac
SHA512e86b3a011605199be162e4e72da643bb3675680f75872cfa1672a1dd409d78aef6d892acbaaac02c7f38aa7c54ff09f8572ab105e6dab83d74a7aea7657a35a0
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB