Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
115s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 08:11
General
-
Target
6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02fN.exe
-
Size
212KB
-
MD5
5b8bbe2c2b7e463f37570faeffe07f90
-
SHA1
f59a3a1ada84df57fee2cf1a4092ce597b2db961
-
SHA256
6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02f
-
SHA512
7b808666274dff0b7ab1238766844385ffc5a3a880370ae4c9933ee983c59e10e6445ee27eb35fc5be1272d930168769314a8896eb012021c3f906b31b3217ba
-
SSDEEP
6144:tob34ERMS/H7YAVsobrVn5G4E3Hi96mbQzJWFO8Omw4GZ:yboEj/8ASWM4Ki96/zqIKGZ
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02fN.exe"C:\Users\Admin\AppData\Local\Temp\6ec18ecbc324b01b5e35f7035035832f63178d59be70217ea176b28011fed02fN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD50cc1a12dfff97a16fe7bb4cb80c2d4b1
SHA104b4fb1d37596b2988f330de5781544063fa0fa4
SHA25649507597998a3341d1be7b55284fc1bf740175b8934cffb2f1b99debc99fda98
SHA512b639b35e010b0fc65a4474b8e7b88cb64e29b4526cd8291f9fe2ad793fbf766eb8b4656aed038b84741ff2256c11a25f7e452ddb63a461544bcb3b114365fd48
-
Filesize
24KB
MD583ec474bb6abbee146fdfa3614057818
SHA1519f43265ea83ff2b657d2506b3fd6fd036581fb
SHA2566c2221b5d74a0eb60d6e94d98738e21f49423a04fde609e197e851ae6b5f5454
SHA512c3cc4247289145d3851c6a3396a32e555a9572d77eb83ba7bd2c20972406ecca02b79826736f363012e67f04b807e437bece2debf79f33965818f0ef05c5f030
-
Filesize
61KB
MD52f241cfe7409b77d5b0111485c1c189f
SHA14f6b34bc983f549afcb700aadeae28afea5bfae1
SHA256443d7d838f615f0950ff4367d9449cf1358f817cfd0116d131072990e9c8dbfd
SHA5123dbcb7c6d77f23347352dc6e34828530245e493c333944f24cf55a629065fcabf1ecdd1756e4a9057a5737b692209cee4fe098c84d170047dd4342909563b314
-
Filesize
481B
MD5c13e7efabb50362202dc05019aaf6e57
SHA1e561a76c44f66eaed21030a674895ffb4df345ea
SHA25651c59f98d46d1748eb8f8efd3f9142ad5ddc10c2d2f12575ea94f53ca78c0bef
SHA5120d8b0a3ae813117abc2a3684d0595acee3e6e392186c62a075351bef3bf117134cd7144e4813ff67179c5402ce61c2f425da0d67aa11207f33385407f450c51f
-
Filesize
212KB
MD5dc739c428328c62528a54f079cc31136
SHA1454fedc876528635620c1bf88174a6f69b0cae3f
SHA2569816295dc0c5cb4e36a6ad9f1c043899fca997d1879fef1f3f47160a52ef337f
SHA512c53856d00e14e5e9bc08647daba06b6aff92666be49800f774687931efd47dce1e466c28781ad241a4ccaf21a7fb23db9b66dd26d72ee008098aeea0a1db83b7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB