Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04/01/2025, 12:43
General
-
Target
77a7b378bc5d8434e1720e0da34398e2fc9a8b6b08ff0265e5d4706f98999104N.exe
-
Size
211KB
-
MD5
063373b7cb8cbecefa5a9ec7dda2d4f0
-
SHA1
16520f601f8446b345d1fcfdd94c0df4273ea716
-
SHA256
77a7b378bc5d8434e1720e0da34398e2fc9a8b6b08ff0265e5d4706f98999104
-
SHA512
18097a3627d29b11ca5b07af9306ac469e298655f9a81885458d6302f550fb29e4222e447b902f45b24c245bc4ee7be893e7426caaf015d32f59583035c9c4ed
-
SSDEEP
3072:fg/T01/NkSp48GzFoMVZrjB2+4M9eOpssvSX4FzU5chdhGulEV5SCmGFkInV/0at:sErGjVqiFPGYrGZMCrCIn6aQdM
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 7 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77a7b378bc5d8434e1720e0da34398e2fc9a8b6b08ff0265e5d4706f98999104N.exe"C:\Users\Admin\AppData\Local\Temp\77a7b378bc5d8434e1720e0da34398e2fc9a8b6b08ff0265e5d4706f98999104N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5128a68a47ff6fdd7e5d60beda92a64c6
SHA17312f57fbcf226b0f8c896e679bb733ffd5e4429
SHA256bffa0f00331eeb46c2f2251b567879f1442f686e3f2f8c5aaaf0c494546452a4
SHA512ab30169f757b063abcf2fe466ca3d1e4d224d9ec5474c0d0980cde73baba2d425002e98ee973a341d74add408adddcffd992dd05855bc4e06b1b2f4c56809c08
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
576KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
576KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
576KB
-
Filesize
732KB
-
Filesize
576KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
576KB
-
Filesize
576KB
-
Filesize
380KB
-
Filesize
328KB