Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
17/03/2025, 19:41
General
-
Target
0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe.exe
-
Size
212KB
-
MD5
5a4791ac48468e167a01886347e3b97c
-
SHA1
bc07b37df81e83db17043911356d3bab7fedb719
-
SHA256
0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe
-
SHA512
d36be2957e914fd31700608dbc5ebb4781d27af406231c1f2506e568bc2ea2cb284058be475bd22122c28fe4167586d60a73950b100b0dcdac3c1b67b99a760b
-
SSDEEP
3072:XGwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb8:XG/iVkO20SFgBhxtW9mG9+Umt3Ezjb8
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe.exe"C:\Users\Admin\AppData\Local\Temp\0733ebb40ac18cc7e8595e28a4a62e867330481f85091f2a0690a98f991e7dbe.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD53c8e998cba9c8a2c65fcc4aa7891548c
SHA1ead80adafb4272ce0e5c75a037782454371a27ae
SHA256d3b21b4525d8869bf253e9821fb75590d064942e215cb3fbf08ca234fc6714a7
SHA51290ac19f0520ac10a2b755e67cdf6ef2e695fde81236e576c0f7f87224335957d79179523bccb011464bb0ff44c728cb57f6232441a5a362c821cf9be0524c455
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD512b52000d8fe3886fa57522a6615d2be
SHA17c7e8e16ed85498772edf4060be74adc6b8f3d5f
SHA2560c781139808258b4bc096c6e1161df569d92199cfe8b5f27f92984b35f16565f
SHA51224a090b3b291fd5a92b25ca5b1850c7c6ffeebafd1bb230d8426f6e4dc7afc4e94a32f29f5eef56f7322807f512ac4cc13a557e260adb272cb515eaedbbd3576
-
Filesize
28KB
MD575247279ee8e7b3b5696566436bf5aa4
SHA16bdd5d2c11581c8349eda3d9a7ce456a69c407f9
SHA256d00f67e5a6c2a47abb214de875bcb76e62f1c41101e8024ae5b9483180c51efa
SHA5126b3927054d13b4cebbca65a9fa7f6f070064b09f907f0d07279d135f0e2f8b192d68a784c5da8ad761103bb6502b8ebeaca8a5da092e9b6b87e4d8b8d669eef2
-
Filesize
28KB
MD5f1cba299aeedab8b371941264f01a2a3
SHA16c5cbe8fc0f8ed7b25747d8d1ad16ba804a858eb
SHA25644a89685b9cedb295c2b02c37a4bbd4e1fe1c9b7f3b2eaa628fe95e73c6b12fc
SHA5127bfd4c9e8b19de22a2762f0611d7bc0e6e1072fc98e919c5cdbaa6e5f2214a11e1703eb357003bc458158573239f0ac4fa61ed5a285b957a0401c447f11fe527
-
Filesize
212KB
MD58a8fdcb064e80c5d141cb5c5be8fc577
SHA1634c608e30e82a8110e3b9157956834d36162d83
SHA256a69a29f275697ab38791c95d2abbbd401c738600cf8055317ecd15182dd57cc9
SHA5127648c1115a1be0d80ad98af90f7c32067f85584a11c301ae30852c86b355c774677f3fb2524bf991a4403841ea4f577fb9f25788c4c6ad131a0c3d1eb033eb45
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB