Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22/01/2025, 15:31
General
-
Target
a684d50a0da3ee52da611676fa2577f42ecf2eeeca14e648a41d44153bce185dN.exe
-
Size
213KB
-
MD5
f49f675a2467b0694cc434d4e5997bc0
-
SHA1
20fa6b56a20298fc38e609b6e91023ef42829fba
-
SHA256
a684d50a0da3ee52da611676fa2577f42ecf2eeeca14e648a41d44153bce185d
-
SHA512
a98f75fa151a6f994a7419872422e4b72fb6aba0a3b651bb4cba4544d6b9b1d1a00687f25d8bacae2e185e61f2d18a766eed909c4f227c388765934c4f6ac739
-
SSDEEP
6144:oQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:3Xkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a684d50a0da3ee52da611676fa2577f42ecf2eeeca14e648a41d44153bce185dN.exe"C:\Users\Admin\AppData\Local\Temp\a684d50a0da3ee52da611676fa2577f42ecf2eeeca14e648a41d44153bce185dN.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5d54ed184b90959644f1224175ccb6f4b
SHA10b401f63514ad1fc67ebd960ca070a4a025191fa
SHA256f8585d4bfa6839484fad8b48e83bc10c9088f1153f4b70c686e16f61294f3631
SHA512e8bcefa1ae3a7ffcaf118d09747e8a94490ee533c2dece3bf2756001fed5d70694ebf91ae5310745e63c2528ce21a98300595118734afbd9aa005c84e2f97289
-
Filesize
213KB
MD50bcd677e9d8c1cc5ee8715ba31043910
SHA1dd7cf226fa8dad7bc4fe46913b72aa3665388b6f
SHA2560ed0ef9a5d7d75fc16487f0d1e2358a0e13f3868e175a12b9deb6660865eb1a8
SHA5123c108e22e8c9831bd3be019b34e80780b55f42c921ea5395f074d517280e488f9ced7ebd40e8b72d0d65348c938500c27a459e91db777fbd40c59b70e8e3d23e
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
380KB
-
Filesize
324KB