Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 00:52

General

  • Target

    71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe

  • Size

    208KB

  • MD5

    bfba0821b087628fdb86cd1a779f98f0

  • SHA1

    ae252e625987c7be3982a768060912bbcd34e695

  • SHA256

    71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11c

  • SHA512

    9621d508fee45525d07238725b440fd097ec851a7cd2c0e06efd5b50dfd03650a11ed03cda8933015662cdf9a43bbdb2fac7de178c0bb428a375aa2f18ba0aee

  • SSDEEP

    6144:LOYX27lPBA3YDMw4lj6idlMlwl7/79C87:LwBAy0rlMI5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe
    "C:\Users\Admin\AppData\Local\Temp\71cbc63b98b66476cfe1b22bbbe58708f55b2956b10d8c20c9ec9351b46ac11cN.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AA99.tmp

    Filesize

    24KB

    MD5

    e140efd5f8d38457f32c84123122b9be

    SHA1

    9e547603c9bd4d11486354609f235631303d7f7c

    SHA256

    493ee501148bb773c95fee3d8f904c9e70c43f9fb75c418cc56a446654d455a2

    SHA512

    efa692a00c8a6d48bd6685317acbfec032d0a20d9febddb34974aa203644d2327cb697c7ffc750e1c61867c43a00429b54affb9436d10fbf34b9b1008e858475

  • C:\Users\Admin\AppData\Local\Temp\AAF9.tmp

    Filesize

    1KB

    MD5

    dc69b100f7f5313672bc594c3233bce2

    SHA1

    7e4282c1aeefe4c277a8d68f7c8484276a6ea91c

    SHA256

    a724464a783a9b61a48fbeb6b1969de22fb99cadd921afeeb84c47a33eeb56eb

    SHA512

    32e7980732770c0467ce326d6bec7f60363ddcb2251f31079d30254e12bc6ae22a9433814e71ff01e7ffd005df00167d34fa53149abc2056b4fed0b123cc7109

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    ecfd40da7b457e5d4794b4ebbee6f77e

    SHA1

    e9d5cc17263aa2fbaf10da2aced3a2e2fa58c36e

    SHA256

    2ffb7fc76837c5e0aece90b4e63c6adfee1ab6e36a761282fa20e360767f82a5

    SHA512

    4178541cc5c258fa0fe069c5be025bb30d1c2a523091eeb8bbbe057caf64dcd59f8469ee147cf462a163472cf3f0fbb9eb7751b1591c97d19a0106c8a283b907

  • memory/1368-0-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1368-1-0x0000000002220000-0x0000000002271000-memory.dmp

    Filesize

    324KB

  • memory/1368-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1368-13-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1368-15-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1368-14-0x0000000002220000-0x0000000002271000-memory.dmp

    Filesize

    324KB

  • memory/3648-16-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3648-12-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3648-17-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3648-18-0x0000000002A00000-0x0000000002AA8000-memory.dmp

    Filesize

    672KB

  • memory/3648-19-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/3648-20-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-24-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-23-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-28-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-25-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-36-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-78-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-77-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-76-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-75-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-74-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-72-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-71-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-70-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-69-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-68-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-67-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-66-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-65-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-64-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-63-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-61-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-60-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-58-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-57-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-56-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-55-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-54-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-53-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-52-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-51-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-50-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-48-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-47-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-46-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-45-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-44-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-43-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-42-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-41-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-40-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-39-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-37-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-35-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-34-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-33-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-32-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-31-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-30-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-29-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-27-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-26-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-79-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-73-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-62-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-59-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-49-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/3648-38-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB