Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 05:20

General

  • Target

    7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634N.exe

  • Size

    218KB

  • MD5

    ee73f7ed31a1ab3533500b9cffeec860

  • SHA1

    c2b70c8c4058cd459e902784ad13d0a5130087d4

  • SHA256

    7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634

  • SHA512

    05a965b8d30d401d8b8c7ac3a2228de8159d189ce814011d8cecd84291b2d4b4286370ef0281bf8447f2d40759ad73eb6d13d251c51e9d094a2fd6f29edb5827

  • SSDEEP

    6144:xEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:xEGDdQNHEwWlMxYG/wI

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634N.exe
    "C:\Users\Admin\AppData\Local\Temp\7488cee0f22f567bc3481c966246accfec3daa8369ba4e7a2bb0384d24dbe634N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9725.tmp

    Filesize

    1KB

    MD5

    662d27bf74598fc154e1a51327733e16

    SHA1

    d1fbe0f303212a4c8a62dab25073cf685a7b8837

    SHA256

    4b5d0910e9ce43436818a4217b86dae3706fcc3a232063af3c8a7d1e8f7ade73

    SHA512

    e757b303ca745c7c430b31be47e7d64d6a901daf9267c1df4bbf8e4eff99d04423a977c1a3c320c3d38014225e8afacc1186b8c36f7833b3495617738298e574

  • C:\Users\Admin\AppData\Local\Temp\975A.tmp

    Filesize

    42KB

    MD5

    43b9834f1e990829d9f6dfc064166f77

    SHA1

    46b07d410f1bcc98ee425475e6610dc2c23e3e34

    SHA256

    ac5434db4d52c6a16dfa15d22061ce82617c9fde0ce19efefbbab3f1f561e603

    SHA512

    a8047e287ec55daa7e3db861555dbdbc3c61a57fb0cb9513564e67aa4c12bd47b98fde41fa5a245d537b373c3acf0840f314ceb0dfc3e2b40531af34ca649514

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    218KB

    MD5

    11e03ef9eaa315861425ba66f48bd653

    SHA1

    4b4431c5d9c70867495d28ebcf8b7b762c614965

    SHA256

    82d4a917915bd41d88fcca25e0755f49d52404a8c6451d903447d708190c03c6

    SHA512

    5d64633985186a8c130623f187e78ee89f9660ee28e2a4118b6d09943641bcdcca8808c065d3b7e478e2c2dc65da24b4ba86716944c65f82d0d2b4b158f59ed0

  • memory/2180-71-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-68-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-19-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2180-58-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-59-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-41-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-24-0x0000000002470000-0x0000000002518000-memory.dmp

    Filesize

    672KB

  • memory/2180-30-0x0000000002470000-0x0000000002518000-memory.dmp

    Filesize

    672KB

  • memory/2180-32-0x0000000002470000-0x0000000002518000-memory.dmp

    Filesize

    672KB

  • memory/2180-33-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2180-28-0x0000000002470000-0x0000000002518000-memory.dmp

    Filesize

    672KB

  • memory/2180-26-0x0000000002470000-0x0000000002518000-memory.dmp

    Filesize

    672KB

  • memory/2180-34-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-38-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-36-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-40-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-53-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-81-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-84-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-83-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-82-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-80-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-79-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-77-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-76-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-75-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-74-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-73-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-72-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-21-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2180-22-0x0000000002470000-0x0000000002518000-memory.dmp

    Filesize

    672KB

  • memory/2180-20-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2180-61-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-70-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-67-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-66-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-65-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-64-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-63-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-62-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-69-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-60-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-57-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-56-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-55-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-54-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-78-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-52-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-51-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-50-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-49-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-48-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-47-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-46-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-45-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-44-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-43-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2180-42-0x0000000002620000-0x00000000026D6000-memory.dmp

    Filesize

    728KB

  • memory/2520-18-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2520-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2520-1-0x00000000006D0000-0x0000000000721000-memory.dmp

    Filesize

    324KB

  • memory/2520-0-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2520-17-0x00000000006D0000-0x0000000000721000-memory.dmp

    Filesize

    324KB

  • memory/2520-16-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB