Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 21:36
General
-
Target
04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47.exe
-
Size
213KB
-
MD5
3f3b2748c4eecd51d87187343458662d
-
SHA1
09a6d086deb806bb11e595c44d9d2c922594af90
-
SHA256
04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47
-
SHA512
cda8db4aae7d20edc5f6eaa620c912b6ce6b823b8b8069da648f8f09e4a3428f0d2be44b8ebc84466999e020764868f970a44de39cad97502305cafc88449242
-
SSDEEP
6144:oQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy6:3Xkej+f4VDOEVdbgt/
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47.exe"C:\Users\Admin\AppData\Local\Temp\04e45f558869590927ff9351519f3589f3d06856376e274e708d78e434caca47.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5a8fc816240c29cd6cd3c1b0da967ba72
SHA1011518ff7f5cc1dcd47d2205e86e76844e5a2a14
SHA256280c0d185cb7157c49546198869e4e2beca5814c9f704561599e5c41c055ebe4
SHA5126d99f82468cdb0b08632835145909d4f8395cd6671ae4f0e27ba5c8c50aba017a16808377ddb17408c43eaa2f02bc824ac87047216f7908a40cc853c29592196
-
Filesize
61KB
MD5f30535e40a63274c23ed5ebcbf7b4b6d
SHA11f0f20a41979822a5bbc9120e6c3c237f1773f7c
SHA2568d2b8040bfa5784e906b9fdb92157010b1683521a0efe3f74857273589ecf259
SHA512386636243526392dcaad4d99416b2c24f17bef42ca3a0bf98b0870f6a4289ccbc98d737db836d6d3212105f198f052691da3620e8d7de8e976bdc9e29e9336f4
-
Filesize
481B
MD5bddc81160838e4d94d47acfbd1559f47
SHA176c5ddaf9b480b0e3ad38dd2ee94bcdd39637891
SHA256358b696656aa9f351e87b5ea0413d9d955bcd50cb6490a463027b15de42dde1e
SHA5121faf5d7e69fcbd53810fbb5f615b5398b2fea40c8df98b361e14dcd4ff4f2fbb608d205c4d24eb281cdbd2fbe27ce1a854ece1bf8effab4910ae0018cf63388b
-
Filesize
213KB
MD5034e3d112ef096a65747acf4f213a116
SHA13ebc72f64189415989788f3b479473eae9df274e
SHA256dfa1fea48439d1055a0f33b3a0a1307ce1840b267cef0db9d03dc349e1a77698
SHA51290ba08f73732c4bf2945750c932d2fef40e3569f0cd60d50498dde2fe398815409b3911b7044bb0dce789916c657ca3b943f286bd2350b2781f71aaa1563ebb3
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB