Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14/03/2025, 16:13
General
-
Target
JaffaCakes118_74e1172d52b664d83ba476a80b3a0700.exe
-
Size
206KB
-
MD5
74e1172d52b664d83ba476a80b3a0700
-
SHA1
5d646ad9446b71eeff51f96b5b0511b3f851eae2
-
SHA256
8a331ddd4c685fee40bc983711d59212e38d4655e53469262baa0dac05b542d2
-
SHA512
397dd4bb3aec1f7b03c2204969f016bef38e1fefdfe30b3112692bc9746f7ace6bb278d2fce877d4954480057fc74247b69b51445812ce18eb0bbeb62940dc0b
-
SSDEEP
3072:zZKoxQb+k9QvlM2UomDQEGPjRHfNtPYuD/V9P8rMz8csf2jacKUSI7Lj/PKbcVGX:Frox9QUkEq9/nP3D/jP8Pcu65GbNwy
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 1 IoCs
-
Drops file in Program Files directory 12 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74e1172d52b664d83ba476a80b3a0700.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_74e1172d52b664d83ba476a80b3a0700.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD58c6c441c39e27bb7b76f797e13b25e60
SHA1933eebacd1aab1b333039fe73a162cc76c67ea66
SHA256775068fec063e576b2dc6684e165922ecc4b1cd496ec0acf0dd4c1fb5139dca0
SHA512bd2fd38cbb6f05c97a76b36af7f1585d86c2a87d5e610ab35807eadae269356263ddec54f6955f8d3c2ab416403b554c37e4f1138f2ad97a59bf690fdd2bbc29
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
680KB
-
Filesize
564KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
564KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
380KB
-
Filesize
328KB
-
Filesize
564KB