Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2024, 14:34

General

  • Target

    e991a432f85daf7fdf0409918efcc9d71966cac5802db995edff8b12dddb3dd1N.exe

  • Size

    208KB

  • MD5

    565fca9549d6991a7c51dd7f44853170

  • SHA1

    b4113a1c3b4131c3b9d36289c902bc40e60bb88f

  • SHA256

    e991a432f85daf7fdf0409918efcc9d71966cac5802db995edff8b12dddb3dd1

  • SHA512

    7c967666166e4c60a735597345fbc6ef892820d245d1d78cb12383196491479c282b793338a4848242cdbefab18dab60af8579284ae5b77e94f5a6d8b2a555e7

  • SSDEEP

    6144:qa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkg:qbapK0JCmRcU9vVokfR

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e991a432f85daf7fdf0409918efcc9d71966cac5802db995edff8b12dddb3dd1N.exe
    "C:\Users\Admin\AppData\Local\Temp\e991a432f85daf7fdf0409918efcc9d71966cac5802db995edff8b12dddb3dd1N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6D0E.tmp

    Filesize

    1KB

    MD5

    400f0264c07582417373be769524fa7a

    SHA1

    896ad353ae5affdefd7ae72d6a7d7ee509383686

    SHA256

    0c166e34c9d6c9d590f8f6412b2d3de1502549bdd4b48154f7c63a2f3bd647a8

    SHA512

    709ad6c211e2678663265fa7c91c0763fd93935f3d0bc1e59795b60fad391474ece81c5325c9a1801daab8965f3c37ad8f71250a82a61d0c27c4a4eb814db6ee

  • C:\Users\Admin\AppData\Local\Temp\6D0F.tmp

    Filesize

    24KB

    MD5

    0c6e68b8dcb7b0c69bfea205f044f047

    SHA1

    13446428c9065acef46789a7aa64330e0a7ae8d0

    SHA256

    aed28f31ded7f09adbe7e1cf0577fd3f531c80102ff5d2c9686707296ccb4b2d

    SHA512

    5e8c3f942253e9c994a4287c4bdc0f4868d5e6694c89fe50275b1c92b1fad3bfb80948f804ef4c19fe9f6bed5bcc5f0f914c37e0ddb5e85e91ee6410f21bc821

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    9394def03e78084f05fd798981ed6ae8

    SHA1

    ad162f55d44eb4468448fb883a3cc803b221eac6

    SHA256

    0b8f7382182a70388d0446487c9446234d960439dd381564fcab26dda4b67c08

    SHA512

    5926cfada54fba6266a70f56a090d0af480a142a654c9ad9dce1b61f5662b5f2d557fdf81c8e68f303439df2c317c666085739206ba4b82147f796a25820230f

  • memory/1624-56-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-54-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-24-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-46-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-18-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-22-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-20-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-30-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-40-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-79-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-78-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-77-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-75-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-74-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-73-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-72-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-16-0x0000000002750000-0x00000000027F8000-memory.dmp

    Filesize

    672KB

  • memory/1624-71-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-70-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-69-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-68-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-67-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-15-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/1624-66-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-65-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-64-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-63-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-62-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-61-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-60-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-59-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-58-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-57-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-53-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-17-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/1624-55-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-11-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/1624-52-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-51-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-50-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-49-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-48-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-47-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-45-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-44-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-43-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-42-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-41-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-39-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-38-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-37-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-36-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-35-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-34-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-33-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-32-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-31-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-29-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-28-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-27-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-76-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-26-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-25-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1624-23-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1728-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1728-0-0x00000000005C0000-0x00000000005C3000-memory.dmp

    Filesize

    12KB

  • memory/1728-12-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/1728-14-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1728-13-0x00000000005C0000-0x00000000005C3000-memory.dmp

    Filesize

    12KB