Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/01/2025, 06:03
General
-
Target
27722bfaca44cf30d85f7282ae3f9ae70fb5304a3dc5420310c227d2f75f5bc9N.exe
-
Size
213KB
-
MD5
472c1634fd95f1edfe18737843186440
-
SHA1
0a11dbef54327f8162ac3324de735d46cc8caa3b
-
SHA256
27722bfaca44cf30d85f7282ae3f9ae70fb5304a3dc5420310c227d2f75f5bc9
-
SHA512
c831b5e5676f8ac155c6b9b6bbc339d528eb184543398b0a8d268df3b63daaa6fd453694da3c32f5eeba6747732f03d9e84339dbffc367c1541bd026d10a81a2
-
SSDEEP
6144:EQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:TXkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\27722bfaca44cf30d85f7282ae3f9ae70fb5304a3dc5420310c227d2f75f5bc9N.exe"C:\Users\Admin\AppData\Local\Temp\27722bfaca44cf30d85f7282ae3f9ae70fb5304a3dc5420310c227d2f75f5bc9N.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD573d9d3d736bd7b3c15456622e943034a
SHA11fb258dbedf33e9b4a215ebc1ba1a2f172d72e26
SHA2565a87123bf8369a205b9e24fd457e6ed7dd76daf4ac5eef82f8e6d5a85ba8bee1
SHA512957981e091219958602baa58e6637546891616e77f77de18d0e1059bcf3835b023457731fea02d5ffb70a82d0830ab2014c5d6e4ae669e255c31d683eb209eab
-
Filesize
481B
MD548bbc84329af558cde954cb1d8bb10ad
SHA1d111d5b48737727ff04dc9ee7de1091a2a6518f1
SHA25699e69cf98707f332850c4b6c43908ec4b1213125d1ed04ca88c7e7fd2ea1855e
SHA512e6ed917134603e21550a610e1282680bbde1358b1d7d73f24b733331e4948ac2295a1b6b8e4e0eedc71a6b895688a8240c42e63e335bf293d518100cf36c73d0
-
Filesize
213KB
MD58089f5d3609debb9550e8d6f8e49be35
SHA1f497b098ffbad3fdf7eda3c0354085b43b12411b
SHA256a2bf8bbe8b038449c4e8be6fd3f0269f5716b2de16fc85e9e6709a6b6d6cf900
SHA5124e8c9cb28d5ad69f46363db32a4ce495daf2363cb424c720099b3af4981480e7a49940237ae25a4b196ca774f864f037de9627b96e1e981e5c11c848a0d6cf7f
-
Filesize
2.3MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB