Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 02:37

General

  • Target

    870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e.exe

  • Size

    355KB

  • MD5

    3f14f5f3463221269c23e37f50c8a2c4

  • SHA1

    0408dc4449926a31e7fcc7b8f6c3b516f3bb61b4

  • SHA256

    870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e

  • SHA512

    5dd24520198b54ad8edb0a773117c1fb1619a2dd51e81572c37dbe53987200609fe9909ba80373710f4d12067e173488f07dc53fb4e4cdd7e5f5ef6bb7b8bd6b

  • SSDEEP

    6144:MgEmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei3:OmWhND9yJz+b1FcMLmp2ATTSsd3

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e.exe
    "C:\Users\Admin\AppData\Local\Temp\870012d834ee7146d3221ec976e816dd76420f55151d32faea79107cb1ca7e2e.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0TSRVAPX\login[3].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Users\Admin\AppData\Local\Temp\79E3.tmp

    Filesize

    24KB

    MD5

    0dbb6c1eb0ae003ecb8aaeb88ce1997c

    SHA1

    6fd9eee52bacad0075f63f58bf89c03687d1e704

    SHA256

    101fc102742905c5354b4c27d475e2e602f8b304e8c586d977a41169650d6e3c

    SHA512

    9c0c3435cf70742c3ad371cc79f9e4c58448467b881c2cb881a20b7a001ddbfb5d23e67b6b2dc71d0f3db6f28ab08ae54106328d21ee954e6bec8371aa66614f

  • C:\Users\Admin\AppData\Local\Temp\7A52.tmp

    Filesize

    1KB

    MD5

    2165edb10c3f4c202e07bedb53d7e67e

    SHA1

    067795020a0e46bf2afde578a2bd96c93ba63639

    SHA256

    bc0ccc5c288c0cd948ff8ef882e49e4393ad599e8a962b4e6aee4b55f42a04f3

    SHA512

    c6450d9df5d163d20f94166605096e1a66cb5fe5946d88a79d3046ffe032e8970d6709881c733ad68eaa0417117fe3cc8b0699e42f93a9469540b980163102cd

  • C:\Users\Admin\AppData\Local\Temp\A0C6.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\E9AA.tmp

    Filesize

    61KB

    MD5

    3bc2c726f922a4ef46238f1926e9767a

    SHA1

    e9ec66a1d5c9be355396b2c04099fc396b4c08c8

    SHA256

    91b500151ef6a20c9348c1b7ad31052decbd79d4290d5549a00ad41399a5b6da

    SHA512

    f330688636eafbf8507f3aefb3d8f3e6c81fc8b5de116b25651eef030a6b81f9f458c2cff6b5ec5dd5ac65ee734a28f10d2e1a658c4ac688f01410dda3cfe925

  • C:\Users\Admin\AppData\Local\Temp\EA49.tmp

    Filesize

    42KB

    MD5

    646807275e244bcee6525d6db0fb645f

    SHA1

    665ea20b20ec165974de808a5ad1e8c34373d683

    SHA256

    4bf12bb08c19e511ef79b573b62ba99df84cec367065b744540b816140ad3637

    SHA512

    7619d2cccd49237a27ddda3d4d143795360c71e41c1b239c80ab704e0c9d7eeb20f3f8b7d3d4728a66cdee7a72e2c3a5fae8e65ed07e6d83139029b93edb6090

  • C:\Users\Admin\AppData\Local\Temp\EA49.tmp

    Filesize

    42KB

    MD5

    1eaa69b66a35efa5cd21cf49eefcd6f1

    SHA1

    6ce7680364423b1406d6f51ae44597d926cb6868

    SHA256

    747e2394911d16d6decc6346f17a6d131af48583928e3b44fd0a2f31132df6d9

    SHA512

    e1e2992d55196443caf1a9abcbb771a73ec8e785f36300965a819dc1c2b74fcd2a505a3886f91753851643ed557c99ffc40fbb141494d06f560c9e090e4da673

  • C:\Windows\apppatch\svchost.exe

    Filesize

    355KB

    MD5

    8cde02887949a35328a0fc65985c92ce

    SHA1

    dd120876901aba523b9deabddbd7461b0b2e5e5c

    SHA256

    738e572108f199ef37dc3b7c85d699e61a25b80e3f7a77477a018ed37a1209a0

    SHA512

    95ae734c0a49bd308944ea89c55aa7d911013f9c1a66d59831a6d9803ecd05393d87aff3bdb3fc986746267fc58ad9f4806db9bb29f1901725731f5d7215f5d0

  • memory/2380-46-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-41-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-72-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-71-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-69-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-68-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-67-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-66-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-65-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-64-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-63-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-62-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-61-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-60-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-59-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-58-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-57-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-56-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-54-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-52-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-53-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-51-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-50-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-49-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-48-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-47-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-11-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-45-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-44-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-43-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-42-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-70-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-40-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-39-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-36-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-37-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-35-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-34-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-33-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-29-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-30-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-28-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-26-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-25-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-24-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-23-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-21-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-20-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-18-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-17-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-55-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-38-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-32-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-31-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-27-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-22-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-19-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-15-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-13-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-10-0x0000000003600000-0x00000000036A8000-memory.dmp

    Filesize

    672KB

  • memory/2380-16-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/2380-182-0x00000000037F0000-0x00000000038A6000-memory.dmp

    Filesize

    728KB

  • memory/3260-8-0x0000000000A60000-0x0000000000ABF000-memory.dmp

    Filesize

    380KB