Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/12/2024, 10:26

General

  • Target

    3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe

  • Size

    208KB

  • MD5

    070e9c8cb132754c3ee88ce0ba149e1a

  • SHA1

    ba97e75607f569a1454664bead3268946941d9b0

  • SHA256

    3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72

  • SHA512

    0d93de4a170b05e17efe8758122e700a130ebd3c915474f82d40cd1265a96e06af18985cb98cb6fffcdaa79d11dfe799a997b128d5079c648ace52c5a2977ae8

  • SSDEEP

    6144:ka1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfkw:kbapK0JCmRcU9vVokfj

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe
    "C:\Users\Admin\AppData\Local\Temp\3825b12895b10bba9ec3e68018a35446152f2597717156da5a25da96c064ea72.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\38A3.tmp

    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

  • C:\Users\Admin\AppData\Local\Temp\4B1C.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\8594.tmp

    Filesize

    24KB

    MD5

    651f005fc9928dddbe7855842328eb66

    SHA1

    c57bb67e042fcc01e29b75274ead1bcf8d1f0349

    SHA256

    85d042ef0e089b59dd23cdba3ebf83374da5878436001366a93bc4bc5725178a

    SHA512

    c9a2538206b4b7c99fd68d4df5bf59a762eeded2b232857cf10b70719878e6eaea33ac57e7a3bb8e7fa5f3780834d688367abfbdda225a4d312463271be1bed9

  • C:\Users\Admin\AppData\Local\Temp\85FB.tmp

    Filesize

    1KB

    MD5

    756ab6f03e220bca39ce318ac97b30f2

    SHA1

    6bcc2d06917d7121a6772a12be5386a172f3bd07

    SHA256

    4a762753dd489f2d1256638ab1a15bab906ace83476d1b09376f920ad5293c6a

    SHA512

    6427aa52d91092d51faca211f0f0dd2d32898a65b90bf9709dec728e6b503ae00f669621b31cbaf981bb034e9a5ea89ae51183b85777a09859219aae95ff53f8

  • C:\Users\Admin\AppData\Local\Temp\860B.tmp

    Filesize

    42KB

    MD5

    53a9087c02e05c59caba795afb6bf8ff

    SHA1

    2aa548b572efb4f0b53aecca371f7679f729f0c1

    SHA256

    79ea66c2ef14bb21c027a6b0998990c6ce4a66a42be980634d8234d767b36d61

    SHA512

    2c8e9128817599be7d836f0e4712119fe168e96513cca0e59146db6a2b4764beace58ff0f960fe792f25bf0a14e74e450103c8275b969d0b816b8e07e882d73a

  • C:\Users\Admin\AppData\Local\Temp\B2BD.tmp

    Filesize

    1KB

    MD5

    05deaed644e2bb65e7e90b02ff37ff1b

    SHA1

    4e2a610b6c3b2be67ec4bd0da0842340b8943776

    SHA256

    0b6a6523337eb160edd849e12d4c7a6e6bb7244e5aa062e6088e574bddf6c2eb

    SHA512

    22109d297efccce688196a8c1a1ff4b2960304ec58286ffb06658a76737af6327cb4ed7db67c27693c0e9d39df10c0d5efca3603df063872e18866f9469119a5

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    208KB

    MD5

    8619fa5bff7872718dfaddcd89e4e437

    SHA1

    dd52fa6752595aac78f1fe3f29869c1c37d34938

    SHA256

    5712ec7bbd421f2aed970862650b7aeb749cfd3ab666b1e6c2eb5dace6bdaafc

    SHA512

    59728c2c7d4880aec7e8e4405256a55d32254cf9c5e2ac206349c195a55b18cac969c2ea7f0e4c86da8310fb3d8190a373fd59f75323166dac874c806f7b647b

  • memory/388-63-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-57-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-17-0x0000000002030000-0x00000000020D8000-memory.dmp

    Filesize

    672KB

  • memory/388-29-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-33-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-31-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-35-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-39-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-60-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-81-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-80-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-79-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-78-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-77-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-76-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-75-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-74-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-73-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-72-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-71-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-70-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-69-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-68-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-23-0x0000000002030000-0x00000000020D8000-memory.dmp

    Filesize

    672KB

  • memory/388-67-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-66-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-65-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-64-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-28-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/388-62-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-21-0x0000000002030000-0x00000000020D8000-memory.dmp

    Filesize

    672KB

  • memory/388-61-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-49-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-59-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-56-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-55-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-54-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-53-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-52-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-50-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-58-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-48-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-47-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-46-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-45-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-44-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-43-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-42-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-40-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-38-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-51-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-37-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-36-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-41-0x00000000023D0000-0x0000000002486000-memory.dmp

    Filesize

    728KB

  • memory/388-27-0x0000000002030000-0x00000000020D8000-memory.dmp

    Filesize

    672KB

  • memory/388-15-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/388-25-0x0000000002030000-0x00000000020D8000-memory.dmp

    Filesize

    672KB

  • memory/388-19-0x0000000002030000-0x00000000020D8000-memory.dmp

    Filesize

    672KB

  • memory/388-16-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB

  • memory/628-0-0x0000000000240000-0x0000000000243000-memory.dmp

    Filesize

    12KB

  • memory/628-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/628-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/628-12-0x0000000000240000-0x0000000000243000-memory.dmp

    Filesize

    12KB

  • memory/628-11-0x0000000000400000-0x0000000000467000-memory.dmp

    Filesize

    412KB