Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/01/2025, 08:56
General
-
Target
dc12cdf5bc24ed23cb8444dd7a69c53750aad7739404170e821e33da1b864caf.exe
-
Size
208KB
-
MD5
04e514cd99f51ce0e9756e6f7b6c6858
-
SHA1
66af3d5bdedafc1c73fb85c02847f16514095f6e
-
SHA256
dc12cdf5bc24ed23cb8444dd7a69c53750aad7739404170e821e33da1b864caf
-
SHA512
75b4d8b1494e10cfcf94ab84255ca7b705e27efda436012f69bd15f4d8747d0168ba6a96ea939c02846bbc286d76497babd508649e660ec1c73b4a67d3372998
-
SSDEEP
6144:Pa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:PbapK0JCmRcU9vVokf
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc12cdf5bc24ed23cb8444dd7a69c53750aad7739404170e821e33da1b864caf.exe"C:\Users\Admin\AppData\Local\Temp\dc12cdf5bc24ed23cb8444dd7a69c53750aad7739404170e821e33da1b864caf.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD551c83b4e99ede01bdf29cb93dd6931b1
SHA10e2ab52b8b45ca7ad1193718f0b41fdaeaf75bcb
SHA2560ecc4814d308573417b2421f6f349f50f7ab19bf304362cd0dbdaf56b8c6d52d
SHA512bb858d50de854e189a6fcc9b38a15fe0118cf1e46d7417c08bdc83c1b657525f33f7d5460b483cb205bd4600fc3c9e02d29140bb8fb3c210c950cfea9c94df04
-
Filesize
42KB
MD5812748994abc9fa2391313f5755bf94f
SHA1374464bd28cfd49e33c501ecbb5f0811dffb294c
SHA256b6e5602aefe204bb9420937882cab94602e22f1f286e23cdb8d67c510d87628d
SHA512908245793f6ca0751e11d01c4499589713becce815e67a81101bd7403249f70d9da037ab70d78ef93ae34b72328ae2139e970f82f19ebb59031b473e8ecc5e1f
-
Filesize
42KB
MD5780d1097dbc1e469f46406603ee885dc
SHA107d0514a8ffd3c4a2371c66d749e8d18aaecd8c8
SHA256333f51b56809461566cfdb6a5e59d6183f2c61e73be1ee82fb3248178b865c68
SHA512cd5ea5b038158301046933ccd76bccdc2f5db99b473da7aaf1e04bb246b33ff13c5f3e5c8ca56d087fff365aa01098eddb42c9255f3329752b59bccd3fc91eef
-
Filesize
208KB
MD5ecfaade6fe0235640bd425b50c74c452
SHA14068e740ea102d0ee8468d54f1378f9d1071d0bf
SHA256ce28a60753551746463f54c9c13e92a615eac6e52a93c5a52e0a901b43913edf
SHA512f5cf6d8bc021f21e5687c71dc6f679a65151a8f203c850af18320f9f0e6d54c5c667b899410dafa47e36d22165502fad6e62ee1f7013bd27c1dc141bf2fc8841
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
412KB
-
Filesize
672KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
412KB
-
Filesize
380KB