Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/01/2025, 18:11
General
-
Target
JaffaCakes118_b0da3bee5800f86b0c00cd6c8d18b955.exe
-
Size
201KB
-
MD5
b0da3bee5800f86b0c00cd6c8d18b955
-
SHA1
8c92a1114e720f96873affcf2f6d311be93a78ad
-
SHA256
212f4915cf4dae8b872d4c11ec0d9dab7386aa9d180d4f7dc2fd52d387c6cb68
-
SHA512
7387548b011299cf6742abcf411868c38eb9460d86b4d0c0ea55bcbf1cd9383894e65489ab9b527cd571a2568bcf7c890f4ddc378d65b5c91da6bb267b64032c
-
SSDEEP
6144:fFQZZuyaYCAgF/8ElUJ4grunG3E3++UZCv2H:fF4HaH9D3grOG3s++UZCv2H
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b0da3bee5800f86b0c00cd6c8d18b955.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b0da3bee5800f86b0c00cd6c8d18b955.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5a45d08ad88c74e0c0d46fbc8652f9000
SHA12452012624e0327b0ddee371d55aaeefff798639
SHA256e02512dc03baf48b2b841dbb8a41951ea1c58ecbdef1c0565b804f7f92a1485f
SHA512efdefb04127e45ec14f24b4c4dc92b38c51a991c44eb204e89c7a31b8d5de16fd28a518ef07e5e71b6fdb3c618596fd80db0fe3944be3933b5c3c62a98a416ca
-
Filesize
201KB
MD5058567522c0911516f5b45e8d6620d87
SHA118e0249a72ef2e4f36a621a7b291ee6ee1b202b0
SHA25631b9e0fad01097ec924449b1d44f2544c82b48c272bd81b08c083ee170557c85
SHA512066ec74d05f848028399da6061121ce1d774a45ee236ee151da94846eaac99d154795e7d03eb4e8d3b3b8e139e53c1316fbd4a41d122f5b5ea8c049b34938744
-
Filesize
316KB
-
Filesize
596KB
-
Filesize
368KB
-
Filesize
368KB
-
Filesize
596KB
-
Filesize
316KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
596KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB