Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21/01/2025, 16:03
General
-
Target
45ba15303dd96b4524e85152812d5309ca8d8156333fe826033a9f84b6f699ec.exe
-
Size
218KB
-
MD5
05ea4f94972a70eb45a9e2f492c21bbd
-
SHA1
4579fad77d7a09f2ffde817f3076fb17d59aee68
-
SHA256
45ba15303dd96b4524e85152812d5309ca8d8156333fe826033a9f84b6f699ec
-
SHA512
899e37b6958bee2fa756524587cede3c927e2c3c3c73e786bdc213ba020917e395cdf905f8f75c79703f97af5698746f277041e5d770e407694574c7af079c06
-
SSDEEP
3072:xvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2Hu:11SyAJp6rjn1gOObn4b6h9L
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ba15303dd96b4524e85152812d5309ca8d8156333fe826033a9f84b6f699ec.exe"C:\Users\Admin\AppData\Local\Temp\45ba15303dd96b4524e85152812d5309ca8d8156333fe826033a9f84b6f699ec.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5b5ad4d5684d0fa78327f593f323a7d01
SHA17aae272d23a58da909d99a2a410d09e5628959ce
SHA256bb54c087fdadcac059512d62b2aabba9cbc64bf2d5e0d0d466dec2024b401178
SHA512f0ccb2706e184f6e37dd84ac4e0029863bb6715bbddfa5c0ca157de04e3e3047e7ccc252ac28649f4518b20fce6cdc30f79287b71e4f589ebf4f27a2bafb46a1
-
Filesize
218KB
MD55cdfc08882b128d7c9c33b7ca078a4a9
SHA17f40880d526fa87d56694a29134d1ea43d4b753e
SHA256fd4474c636166542ed75220322007b8b5c63ccadf7ecf174e7a45d22064b3e36
SHA51247d4da3d3fd996a8beb3a3ac1e1d5150ff0753d1a8278c53ac693aa62e12d915bfbc42861ba1b657fec7e0087fc231469023d6e87caf3e0b601791b269804cae
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB