Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_8a9aebfa1f0608fc12cda9167e2a11cd

  • Size

    266KB

  • Sample

    250328-mzvczawrz9

  • MD5

    8a9aebfa1f0608fc12cda9167e2a11cd

  • SHA1

    a11765e12d4341b8db1dfd84adebcbb2baf4138a

  • SHA256

    ef970fdacc58e750705bc0b7b6b11a47c3162711229135c49741ec12efece484

  • SHA512

    e741528a74278740d84560cffa52d1632d1ad1ef8a77e49e2b24ec92c988feaf1d752e39b993e710724bdfb4b906c42792eafce79e6b8a2e8e6121edd00583e2

  • SSDEEP

    6144:aXtW3PhCyc/BAnkAsgtv0ogX2475K+pQ9yf2+GMHxbnuhKeibq3OM:aX4x8ekMvVgX2Q5ZpQ9+371uhM

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_8a9aebfa1f0608fc12cda9167e2a11cd

    • Size

      266KB

    • MD5

      8a9aebfa1f0608fc12cda9167e2a11cd

    • SHA1

      a11765e12d4341b8db1dfd84adebcbb2baf4138a

    • SHA256

      ef970fdacc58e750705bc0b7b6b11a47c3162711229135c49741ec12efece484

    • SHA512

      e741528a74278740d84560cffa52d1632d1ad1ef8a77e49e2b24ec92c988feaf1d752e39b993e710724bdfb4b906c42792eafce79e6b8a2e8e6121edd00583e2

    • SSDEEP

      6144:aXtW3PhCyc/BAnkAsgtv0ogX2475K+pQ9yf2+GMHxbnuhKeibq3OM:aX4x8ekMvVgX2Q5ZpQ9+371uhM

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks