Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/01/2025, 00:50
General
-
Target
e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369.exe
-
Size
218KB
-
MD5
0a6b2d129bc4f30ac51335439b552189
-
SHA1
74c32723fe8988aab6d90e7f45e5de8172dd3a92
-
SHA256
e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369
-
SHA512
d19b678ff4281d1b1111fc5c887095f067944387575693a5ba2cde48c592aecee90036da12d306f56e2772a11f3b198228c6cbdb32b321d5a2a1d82356603743
-
SSDEEP
3072:tvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2HK:h1SyAJp6rjn1gOObn4b6h95
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369.exe"C:\Users\Admin\AppData\Local\Temp\e4507790c4ba961ff843cfa7eff830832ee3c1166c6cdd9817c91c61ee0e7369.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD52edb4c500cd02778adc001714e9c73f4
SHA1d53e0607c088208b0ab5431f974dc557b928a335
SHA256dc1a9e880da4dcda6bf482696905e298d83c064f91f9a9d19456aef12d378e00
SHA512051c308927a0fc87971d0b16c275211b700130b5fbfdf7fe2c7a14fade9b169f936325af7e018bb3101cf8d6c02ddb02f82f71dfef04841a5bf46deeeb80a0bb
-
Filesize
481B
MD52a9468bc3c3f86e4694d9aaf1063baa3
SHA19f297195c9bba45cd29cc857f157a86f3475f11b
SHA256f1bcadc75dae3367df45762c19b7004a862d09a6648ede96436de46b180d0656
SHA51204f3dc723b55148ad1575d1458ae66fcb58253c2e4f63f02c2fe4e1e937c45b6f91413dd055cfda7b6af6c5345d82dd36a32b4bfa99742c05c064c96c3ff58fe
-
Filesize
481B
MD5de6688fb2f5da0aaa7a5db81a9fe99ee
SHA1c299d31c50cb43f6373682e47b0213b0b6b9580a
SHA25676bf6f337ed44679a17799d07f2cd6cf5de8dddd27e95c8b82daea8f673a8ada
SHA51231a2332ffed41fd327718aed6bfb2a18d64b68097b504d2d973b8953416c8b9fb0e07bd8d9e8c47412e15bd8f50d916b25fc3dca365eb1c97bf9ef6f327a5e77
-
Filesize
42KB
MD5fcf62d3dd67daeff9252f9c82c1ae309
SHA15184b9e3b146b3e4d9a72c4f1ad58fec26877d62
SHA25680c5d0509419e4750b1d7252b1b68a5de63a23f970eee4d40367dbdefa12ad5e
SHA512f7724881eb8e72f5a285fcae123acd00698293416ede021f72b522be0562d6441f0a799a56a976ce54b1be53290af68812cf91256dc02afe3f001c7e15c4141a
-
Filesize
218KB
MD5c3a67a58f63e336602a9e43866baf974
SHA105a5ac0a53a2b03f921541791211e5e3239287da
SHA256e4610517d0a425ef34484294c66df04509bbc2e51ee85dbda367d6ae859a53ce
SHA5125cfe04be54c9b0e88d7390d874bd0c823e8aae4a30d99346a7c709a20bc368d02b7e66adac02d2227672300a10b26fedc1238761537425b3641dd0b9581cfb42
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB