Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/12/2024, 13:33

General

  • Target

    8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe

  • Size

    204KB

  • MD5

    5787cc3375ddab36955c3ccebc3ba670

  • SHA1

    1e9bcc8297b3df71f3cfe82fa4fb62bf60019f8c

  • SHA256

    8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58

  • SHA512

    6ba4331da1d33babbcf688073a0736756b1e346b8711e518640ccb0d82b0e12296e77986de8e103c57b8171ee178c9244b6f243ac496870c649ade8804cf2354

  • SSDEEP

    3072:m5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAQ:mLexkuRaX41xoyJV65gzyZko+uc

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe
    "C:\Users\Admin\AppData\Local\Temp\8c7972b3389f997b78a97f46ee3c61b11945d1f6904b59f0be924a8238447e58N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9C26.tmp

    Filesize

    42KB

    MD5

    0a02f4a76260c95a2f76001f409a182b

    SHA1

    76f7efd6eb37cbb4ecee5617b1c58580fd7c5b89

    SHA256

    fc4ed8660243972b3f28f35ab372a12659a5fe91c96e3921442c56277c4a4780

    SHA512

    f527a785b343adb4cfe7fbfa9bcada4599c3bb2db9d24ebedd32b0edfaa3986e11f72156ee8859c92ae7e966578db07cb2dc1a661d911770d13456ff21b98a29

  • C:\Users\Admin\AppData\Local\Temp\AD52.tmp

    Filesize

    1KB

    MD5

    6e605d80820349017af9299a33a6a769

    SHA1

    1c45fb83f4e8f53efad0a33f9d5803a3670c139c

    SHA256

    575b1b0863c04e3aea349d0ad5630bbfd0a24dd9f44d83b7843571a0403241ea

    SHA512

    97b3b1a324deac60b47f5aaedde356dff61281b9eb210e23563321bd4bda9cdb6d6d779e3b33d510c38a9f50be1554ecf17ed043415de538653cd50569ea8168

  • C:\Windows\apppatch\svchost.exe

    Filesize

    204KB

    MD5

    f0bbbf1dac55cb1a0160177cb75f15b6

    SHA1

    c0e5423b73486e550c0bd6ce9618387275546939

    SHA256

    02200670da2065fc778aa988650a17d47c6e3e47ae00230eef07aa7b68ddbdab

    SHA512

    a45e45a265bc141fce40b956d7dbee5b73d593cb48ae0127d1af89e3ec69dc75eb0cbbb98159e1ffaf3868fabbc7d52bc0296f3c0fba02b243b65610083733d8

  • memory/888-54-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-52-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-12-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/888-13-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/888-30-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-38-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-19-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/888-20-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-24-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-22-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-27-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-79-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-78-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-77-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-76-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-75-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-74-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-73-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-72-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-71-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-70-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-69-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-68-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-67-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-66-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-64-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-63-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-62-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-61-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-57-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-58-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-56-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-55-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-51-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-18-0x0000000002B40000-0x0000000002BE8000-memory.dmp

    Filesize

    672KB

  • memory/888-53-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-17-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/888-50-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-49-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-48-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-47-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-46-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-44-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-43-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-41-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-40-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-39-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-37-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-36-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-35-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-34-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-33-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-32-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-31-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-29-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-28-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-26-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-25-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-65-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-60-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-59-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-45-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/888-42-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1668-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1668-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1668-1-0x0000000002340000-0x0000000002391000-memory.dmp

    Filesize

    324KB

  • memory/1668-0-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/1668-15-0x0000000002340000-0x0000000002391000-memory.dmp

    Filesize

    324KB

  • memory/1668-14-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB