Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11/12/2024, 07:07

General

  • Target

    ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200.exe

  • Size

    218KB

  • MD5

    3a1f35d8a236091c3c538363386a5866

  • SHA1

    2495a6178448a911aaeb7a3b1102e0fce9b563b5

  • SHA256

    ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200

  • SHA512

    b0ec350d256cffeefe2a13bb3aa24700900d7172bef67371fc847249a89fd0a49a9f12bcd9be3cb5ea40428653c27ddde9df583b754f68fffe34cf8cf68346e3

  • SSDEEP

    6144:xEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwICC:xEGDdQNHEwWlMxYG/wIL

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200.exe
    "C:\Users\Admin\AppData\Local\Temp\ca41bde4f18fa9c7ef5db812a5778746e37a790cc83f61162bdb457105828200.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\245E.tmp

    Filesize

    1KB

    MD5

    3377819ed00fda0c51e57eac0cb201d8

    SHA1

    0daf947b21f2dbd7ad698f0f8ed50c009defab21

    SHA256

    20ba1838e58842bac71cd11949ff757b79452a8a91f1bf1dfdff3d6bd559ea8c

    SHA512

    9d7a03fdc532711bf4e10fc58f045ee0d0a32089c9688dca842192b791970b549151a4e83807137b3fb8e8e8beb0829d8fec5a306dfffe091db9fdd383147850

  • C:\Users\Admin\AppData\Local\Temp\246E.tmp

    Filesize

    42KB

    MD5

    afd6fccf923b989c3734a98beb266827

    SHA1

    c459e9032058419ee28285afbd7d1fcd1924ab5b

    SHA256

    fdd83b4fdfe230a983eb104ccaeae550518af6fd4d7fc20fe114f669edacfd7f

    SHA512

    cabe2b082daa3f1dd19401f92d48bbbcfb70482a5da26cdd0486fa1f89d0b848de4e05423d5cce63965c16befcbd3cb51b4c25405eb759a3c09975490912b539

  • C:\Users\Admin\AppData\Local\Temp\246E.tmp

    Filesize

    42KB

    MD5

    ecbf9c61929a415346d71a72abea0cb8

    SHA1

    7925d2fafb7b321c7a16cec9e7b6c66854a209b6

    SHA256

    b054bc4f357315f981b000b7724856981643642afa8caaf53c0713b976ada8b9

    SHA512

    5a1b1c9a4e862789f03d118b231fcecb4d8a19b64308e35a326ed4da56e07e57aa4cd0520138f2b7249e2d7b78d09dcf9eac99e40fab17a8ece0000dfd66b793

  • C:\Users\Admin\AppData\Local\Temp\BC36.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\F399.tmp

    Filesize

    1KB

    MD5

    e6e57d3a7673c6df7cb2e0a827be1d25

    SHA1

    389c97b1e2bec7cb558c386ada016d7912963545

    SHA256

    02b46a3635f09a308a959046bf03dfecc0acf619b3a3f6a51382171607087623

    SHA512

    690c3331d9ba7a223859c0a3cb17fd3ab9ce44dc853c92689097f56a471937f26b376380f1452c344bcd4cd8f63daf50f757aec8d72ae040524b0658978265d9

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    218KB

    MD5

    9765416c757cc9d0181872c59334ee3d

    SHA1

    b1232c1bc1a62d23c2650d20dc1b2d4504f5bf63

    SHA256

    f46339f5e6febb8d3c627e197f126106179e5ab44dc36a3bb55324350c1dceae

    SHA512

    e4a9260fa9df0706577704d18d3c71038e6907effb9f76012c24bedd807aff223df9a30753364621e24dc7adce7d5383ecd368e7fd356961d4e077973dc8312a

  • memory/2728-70-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-57-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-17-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2728-30-0x0000000002300000-0x00000000023A8000-memory.dmp

    Filesize

    672KB

  • memory/2728-32-0x0000000002300000-0x00000000023A8000-memory.dmp

    Filesize

    672KB

  • memory/2728-28-0x0000000002300000-0x00000000023A8000-memory.dmp

    Filesize

    672KB

  • memory/2728-33-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2728-26-0x0000000002300000-0x00000000023A8000-memory.dmp

    Filesize

    672KB

  • memory/2728-22-0x0000000002300000-0x00000000023A8000-memory.dmp

    Filesize

    672KB

  • memory/2728-34-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-38-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-36-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-40-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-56-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-84-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-83-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-82-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-81-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-80-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-79-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-78-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-76-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-75-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-74-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-73-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-20-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2728-72-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-71-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-21-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2728-69-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-24-0x0000000002300000-0x00000000023A8000-memory.dmp

    Filesize

    672KB

  • memory/2728-65-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-68-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-67-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-64-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-63-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-62-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-61-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-60-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-58-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-66-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-55-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-54-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-53-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-52-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-51-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-77-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-50-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-49-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-48-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-47-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-46-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-45-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-44-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-43-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-42-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-41-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2728-59-0x0000000002670000-0x0000000002726000-memory.dmp

    Filesize

    728KB

  • memory/2760-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2760-0-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/2760-1-0x0000000000220000-0x0000000000271000-memory.dmp

    Filesize

    324KB

  • memory/2760-19-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2760-18-0x0000000000220000-0x0000000000271000-memory.dmp

    Filesize

    324KB

  • memory/2760-16-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB