Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/12/2024, 19:16

General

  • Target

    fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c.exe

  • Size

    204KB

  • MD5

    4c60d92c2c5b2293b1b4b746dabd6866

  • SHA1

    0c45715bb04dae2ddc5ba3334f797cc6d8c5d761

  • SHA256

    fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c

  • SHA512

    ec6c9308e786264d959f3684444028b1fc956886369af3eccadfed356d1430aef3e1f2ec647b6df725a09be16a26dc3d0c86b651c48a52350fdf3b63a8d9589b

  • SSDEEP

    3072:U5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:ULexkuRaX41xoyJV65gzyZko+uch

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c.exe
    "C:\Users\Admin\AppData\Local\Temp\fd8b5802f4ae9db0248467e727d2a98b58f95ea2d8c060c140769446dbc0351c.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BEBD.tmp

    Filesize

    24KB

    MD5

    886fa3a152d872032bd5759a19ee54e4

    SHA1

    c8e5b8f2dc89dfa5f0d9d7c9b301b48422313aad

    SHA256

    3d685c7e80514bc94a42ee15641345edaafe0831317e05f81d458ec96053f3d1

    SHA512

    997b408cf2237f65302a05a179d936023ffa2951f9a1dfb64559031847120271212bb37edc54c7219312961e07774907e814305edea520e11cf597f80727df90

  • C:\Users\Admin\AppData\Local\Temp\BEBF.tmp

    Filesize

    1KB

    MD5

    5e5d47b4183e6b5a135ead4beaaf7051

    SHA1

    3efcdb68d9d83afc05fc7c8072c3ac5a4d6f28cc

    SHA256

    b2cfdd13c40645a1ed0bce28f3219d8a1e8a1592b74b65f7f040aa93c8d090dd

    SHA512

    2e366aa45fd09cf917f53700023d351c1fad009cceca897158754498b69ddd2eae9eb7564dbb2ec1ce3380beb8f2e1a3a280d5f3727ed54256ad978f96a2c4e5

  • C:\Windows\apppatch\svchost.exe

    Filesize

    204KB

    MD5

    9a907d8cdbf23de4c38d0ea57fdd8b02

    SHA1

    f1801212519fd0fd965e0515ddfd54698f69b467

    SHA256

    ae92ce234e9b5a3a42eeaee5463632bc218320fcd6d319de4f556caa03fac3c8

    SHA512

    e7671313152b8b25c4c0e651c4ecd26c2c90ef61780793440b7ca6ecfe75c9eb9a15bcf04214df9ed8955dfdabed913ae7706cc8efd00e2d3df18ae98c56706b

  • memory/4376-0-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/4376-1-0x00000000022E0000-0x0000000002331000-memory.dmp

    Filesize

    324KB

  • memory/4376-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4376-14-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/4376-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4376-15-0x00000000022E0000-0x0000000002331000-memory.dmp

    Filesize

    324KB

  • memory/4996-61-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-57-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-17-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/4996-18-0x0000000002AB0000-0x0000000002B58000-memory.dmp

    Filesize

    672KB

  • memory/4996-19-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/4996-20-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-24-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-22-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-32-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-40-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-79-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-78-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-77-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-76-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-75-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-74-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-73-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-72-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-71-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-70-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-69-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-67-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-66-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-65-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-64-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-63-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-62-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-12-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/4996-60-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-59-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-58-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-13-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/4996-56-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-55-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-54-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-52-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-51-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-50-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-49-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-48-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-46-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-45-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-44-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-43-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-42-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-41-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-39-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-38-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-37-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-36-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-35-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-34-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-33-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-30-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-31-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-29-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-28-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-27-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-26-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-68-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-53-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-47-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/4996-25-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB