Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/03/2025, 06:41
General
-
Target
a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6.exe
-
Size
218KB
-
MD5
7fba57ef0d7e0e2f1662da2504c4a456
-
SHA1
d62c719bfbf0bddae07e4b7ccdee6374631b23ff
-
SHA256
a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6
-
SHA512
dd7ae4f449546c6853dd2400e0f1dbc5b3861fa864346fe797925ff33e8cbdfbdd86a764cbb482576a35a9d96a83cda9fc1751b6c246b7ce4a3d0d9e572695c1
-
SSDEEP
6144:tEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:tEGDdQNHEwWlMxYG/wI
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6.exe"C:\Users\Admin\AppData\Local\Temp\a4e206f25f10476b0a1ceb26477eb1e1c8fb8e29d8400e6d189b0a4a287280c6.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5dd8f259765374e7ba61cb104430b5e57
SHA132a2f33d8d063a754a39e36208d4ea943e477ddb
SHA2567838cd2d7006b2dce9b2abfb1c88d77deb217e0a565f701ff14e84504f13d0c6
SHA512f0ffe1830c502e9065b94dc1193e66ca3fccbf8fc34dab3fc96c7047c87acca0e3307fa1e0e2d272f854b40f2e433d26fb92750caf570f8e7481d71782db6bb9
-
Filesize
481B
MD5a3f334b60e1285fb96fac7ad422e91b4
SHA112617c05ee6adeff7fa2701542e1070ecaeb1b71
SHA256d722dda7342a4c1348a1bae90921ad074a14e4764e430079efe828d722903d67
SHA51222707e82206c1c64be1acb8077498f20f2325e0b6bbbf709d1b68e25dee10cc7fd5c9ae68b78b7d25604be2772cbeb3b790f6bc30ab0802693db3891caeb3d7a
-
Filesize
28KB
MD5246ec5e07a6f96a3fec467c58b819acd
SHA1c9927935d5b306f73d3934e2d4b8d512801ed989
SHA25638f449f825f4fbf6d02a0b433944285adb301cac351c03c6ff609e8bc7e2f722
SHA5123dacd073af378f0cfe8372e32a95ed4c3e2b430232b2e0f90988a227111b03143d9169f308ff0d395f1dd2d2c5a02a1a783a5e263eea95698cf43c260fe2128a
-
Filesize
218KB
MD56577037afb6f87de3fc5e91591eb1c7d
SHA1af7add852155b8a7a00373a432e0ad4b51592962
SHA2563bc5fa9019b4329e7ce71334bf6b28ec21ad04f387309f6adb89179890ca294e
SHA512aceacc29e6d403035b87fa01d714347dc3c8e8d1602dba781889676d7285f35801d208fe95e4419989d19301cc2e18ff3db45b27bbef9ee9eee180949b7b8a82
-
Filesize
2.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
672KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.8MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB