Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09/12/2024, 13:33

General

  • Target

    8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe

  • Size

    204KB

  • MD5

    5787cc3375ddab36955c3ccebc3ba670

  • SHA1

    1e9bcc8297b3df71f3cfe82fa4fb62bf60019f8c

  • SHA256

    8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58

  • SHA512

    6ba4331da1d33babbcf688073a0736756b1e346b8711e518640ccb0d82b0e12296e77986de8e103c57b8171ee178c9244b6f243ac496870c649ade8804cf2354

  • SSDEEP

    3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:mLexkuRaX41xoyJV65gzyZko+uc

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe
    "C:\Users\Admin\AppData\Local\Temp\8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K0PVW9XR\login[2].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\1554.tmp

    Filesize

    24KB

    MD5

    a9adc0511a4eddf72fdd6fcc9cd82704

    SHA1

    6d1f77983622826d0103c5e0233a8c1a00f60ecb

    SHA256

    1e18d293b71cb1dffc33201cf8f08c41eb9de9e8c5d7ead84cd116812a6c59c0

    SHA512

    b2e6c0971529c564ea79c8acc1d7fcb839fd894240c8b1499ea04c50ccb8485ebb614df33b5b618255a9f853ebb45069a8034e4d777dcc4579a64ecaa9320e69

  • C:\Users\Admin\AppData\Local\Temp\97B2.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\9840.tmp

    Filesize

    1KB

    MD5

    975a517517ad411976407cf5664d1620

    SHA1

    1a6876299037afc7fdedd731e033073be76e4c4b

    SHA256

    b96b45b6d9a29d77bb222b1a2e0c1fb14ce8b2968ff18ce4d8e1604bc0b5c74b

    SHA512

    9d991f7fb31abd324ed73d2d2193658770f087b12f989e5f906a330d826c41287c9762369cf0437719b332bd3dd41f8e6354a3a53b3fa059668c19e500b5edd3

  • C:\Users\Admin\AppData\Local\Temp\CB31.tmp

    Filesize

    1KB

    MD5

    91b5b598450d8da7ac5a6365ff73063e

    SHA1

    18110478ef805129a6a1f61edf5bbf49af793363

    SHA256

    7c22e190647ce0c53c2fb8fb06e5a0575a0192b2eb4e338108face455fe8b3f7

    SHA512

    bec20e1e6b2362fd46872fb0b8e59c0470658ac0bd38a9a18c64dc4fe037168ea8d3e42fc0c46f389661fcc145049a662d7de987ff3da34a401e6517300016e6

  • C:\Users\Admin\AppData\Local\Temp\CB52.tmp

    Filesize

    42KB

    MD5

    c349c82dfb0b70e87229aae11e6528ca

    SHA1

    2bbe461bb6ac923a21e8efb55e5fabf9702f2a1c

    SHA256

    55d9e2dd81c28baf47700d220fe009dc20ed195214f584acea524bf2745855a9

    SHA512

    e71a45a606358010c6fa086cd34ff08061821d318ae63e2d33946147d95d9927514ccdf9fc6851d797f099cd7c30437c2e60c044db110ed4473fe5061c2f3030

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    204KB

    MD5

    99bfd2f75e585350ddb0e4ca947e4b03

    SHA1

    ec139beb4ae9ea903a84c89bc83ad52d98601ea6

    SHA256

    bddfbe04a330baa1ba210a2904dc0ec585721cf60e8895bfec1fd5855c2f89fe

    SHA512

    7167433ddbb90ffedde237f506643cc4cb45cde2e3873961dd329532f10a48c0f8cbbca0d0290f9547dbd33bbf56f764aa8f22ea6696714a32db5f021f2c6c83

  • memory/1624-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1624-19-0x00000000002D0000-0x0000000000321000-memory.dmp

    Filesize

    324KB

  • memory/1624-18-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/1624-20-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1624-1-0x00000000002D0000-0x0000000000321000-memory.dmp

    Filesize

    324KB

  • memory/1624-0-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2248-75-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-67-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-30-0x00000000025B0000-0x0000000002658000-memory.dmp

    Filesize

    672KB

  • memory/2248-33-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2248-28-0x00000000025B0000-0x0000000002658000-memory.dmp

    Filesize

    672KB

  • memory/2248-24-0x00000000025B0000-0x0000000002658000-memory.dmp

    Filesize

    672KB

  • memory/2248-22-0x00000000025B0000-0x0000000002658000-memory.dmp

    Filesize

    672KB

  • memory/2248-34-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-38-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-36-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-40-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-47-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-83-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-84-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-82-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-81-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-80-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-79-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-78-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-77-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-76-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-26-0x00000000025B0000-0x0000000002658000-memory.dmp

    Filesize

    672KB

  • memory/2248-74-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-73-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-72-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-71-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-70-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-69-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-68-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-32-0x00000000025B0000-0x0000000002658000-memory.dmp

    Filesize

    672KB

  • memory/2248-66-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-64-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-63-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-62-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-61-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-60-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-59-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-58-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-57-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-56-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-55-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-54-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-53-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-52-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-51-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-49-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-48-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-46-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-45-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-44-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-43-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-42-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-21-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2248-17-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2248-16-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2248-65-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-41-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB

  • memory/2248-50-0x00000000028A0000-0x0000000002956000-memory.dmp

    Filesize

    728KB