Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 05:37

General

  • Target

    e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571N.exe

  • Size

    218KB

  • MD5

    b882296a2a1886702975320efd254ae0

  • SHA1

    9dca5a628225cf93cdef7a84f07dba9455769789

  • SHA256

    e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571

  • SHA512

    c83315c56bc87d6f8d512cf055aaa04e74d707e36ad9e060515a80ff6b81a85b3dbf7442a062b195b7e9379b8dbb1bb65426a20febbf1025429ef456ac1337e8

  • SSDEEP

    6144:mEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:mEGDdQNHEwWlMxYG/wI

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571N.exe
    "C:\Users\Admin\AppData\Local\Temp\e811256076971ff6071d6e1037ee95c402196056f639a559ca24a489933d7571N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3892
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VKYZDMA5\login[3].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Users\Admin\AppData\Local\Temp\1ACB.tmp

    Filesize

    61KB

    MD5

    bc67e78d7cebea9f5f15a407aaaa1aea

    SHA1

    dd18a282ea6b7d97163dbccfee3492c0a59bb6c7

    SHA256

    0d54580902ab554239a838fc1bfc2caf697ca1259a6bdd6fa1eb49dc6a5d0938

    SHA512

    e3253c628f3bb4da7b137303052b9c44033d9d84b363a97400f1610b9583982e74780717dda279195cab6515e0957c69125dc6dccacfe763d3255f8c11594981

  • C:\Users\Admin\AppData\Local\Temp\D25B.tmp

    Filesize

    2KB

    MD5

    a5fc1256900b3ce0f93f4928f795e2d0

    SHA1

    0691908b5dc8c97a78cab89946a6fea955df6360

    SHA256

    428d288609c88876d8daf6d675fa04dda494d577dab34f89984376504020a902

    SHA512

    c0221731d4c94d8263c9029d48a66a978ed37aac11c1778c4d9a1cad5b4dc65237eadb4a993ad67191debab2204843a719dd42386e2a52b053835c34a220afbd

  • C:\Users\Admin\AppData\Local\Temp\D30A.tmp

    Filesize

    1KB

    MD5

    4d3352eeb09f1916c769a98a52c03530

    SHA1

    bcb855ba127595b540d0a16b94fe95f4e29b5633

    SHA256

    0ff8327983194e8f9c4b176a5af587ed4ae09045ee0572fb1f44b1486324cb9b

    SHA512

    f24fe7be377c18a53af13c3c6f69cf534d63f4747581a0c698188df1dea3211f5386a3dc6ab00e08e47b880372bbda3ceab8711c760ea1a481fefd2f5c595b5d

  • C:\Users\Admin\AppData\Local\Temp\E06.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Windows\apppatch\svchost.exe

    Filesize

    218KB

    MD5

    675a787a58b97620a2cc0a9a16944183

    SHA1

    380660938724cb52cd08f4c23d7bf44054347b26

    SHA256

    354632fff0479b51587fa958634f8c15c4e0dad8851541df92b64a35c76a360a

    SHA512

    9747b21b4ff68641361745bbdcb21c8377ac8305753e3e85d38be967d519c26b8ce2be1de2a686546ad4c952ce51d13465115c8fe79b7468d8f9292d45217a09

  • memory/1404-57-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-54-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-15-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/1404-19-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/1404-20-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-24-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-22-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-29-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-39-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-79-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-78-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-76-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-75-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-74-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-73-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-72-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-71-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-16-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/1404-70-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-69-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-68-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-67-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-66-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-65-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-64-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-62-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-61-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-60-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-59-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-58-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-17-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/1404-56-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-55-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-51-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-18-0x0000000002C00000-0x0000000002CA8000-memory.dmp

    Filesize

    672KB

  • memory/1404-52-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-53-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-50-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-49-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-48-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-47-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-46-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-44-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-43-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-42-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-41-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-40-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-38-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-37-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-36-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-35-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-34-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-33-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-32-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-31-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-30-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-27-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-28-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-26-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-77-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-63-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-45-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/1404-25-0x0000000002DF0000-0x0000000002EA6000-memory.dmp

    Filesize

    728KB

  • memory/3892-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3892-0-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/3892-1-0x0000000000880000-0x00000000008D1000-memory.dmp

    Filesize

    324KB

  • memory/3892-11-0x0000000000400000-0x00000000006D0000-memory.dmp

    Filesize

    2.8MB

  • memory/3892-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3892-12-0x0000000000880000-0x00000000008D1000-memory.dmp

    Filesize

    324KB