Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
15/03/2025, 08:48
General
-
Target
c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2.exe
-
Size
213KB
-
MD5
75465c8b7b9c2595465ddc13bfbb03ef
-
SHA1
bf388e942f68ac35421bc15304215d9d603b61f1
-
SHA256
c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2
-
SHA512
84e6b7bbbd1535c6f1c405662390a19af2baf4f7a9767f7529f390d5616c982f88fd3f806921f81ca69da5a20d7a43cccacb534f7b52d8c2e73c397e62189836
-
SSDEEP
6144:LQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:sXkej+f4VDOEVdbgt
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2.exe"C:\Users\Admin\AppData\Local\Temp\c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5803ab363d3aedbcc5fca0abe68ed1b31
SHA15c86268cb3f6c87404e5f8261896b7f92a416ac2
SHA256b7967c532f5c0d6b05f9e9f5a22b9e93983342f095fadd77da17c254741eeae2
SHA5126678501b9bc376809245ff550ff13154743d66bfffa892bd4b6addef6ced5ebc873ed31da7dd03af9981b47fbac9112333664cc26e7698c7a2ee34fcb96e2f83
-
Filesize
213KB
MD56e110ca93d6cfd3cbe2480b7a0c2dd21
SHA1afa6481228e067da716246c32070a9e0ba793f6a
SHA256dc605f184b8a3fe44267bc8bc4503cebb979cc03c199d7f73c2107f2efc375b1
SHA51241c59854c462280ce1ed9c41f975583df404128be892eb57a6a6f26134a75b5eb5ea4eb5182a279c7b2cc79b3e360b1ad210c6c1ac0b912937d14640976aa8bd
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
2.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
380KB
-
Filesize
324KB