Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2024, 11:51

General

  • Target

    f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011N.exe

  • Size

    217KB

  • MD5

    e9f824216eb8070b3c9ff05d413ac560

  • SHA1

    80ee926652a7a7feaf24fe16fe2847350ec978ee

  • SHA256

    f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011

  • SHA512

    687fe39108da2f5618984f25d410a044a3433e408de9cf60c008dbd99c35b742dc95487d0d4e00ad06a043812a2405e5de0cfa36f4ab3d062a8762c4aa204e60

  • SSDEEP

    6144:7rRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:HsTbzu1glovW4EH6Y

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011N.exe
    "C:\Users\Admin\AppData\Local\Temp\f63b89b0518b38d49c0f29bd47bda3f77a87fa6fa6f1c406cdad5de1eba3e011N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8C9E.tmp

    Filesize

    1KB

    MD5

    8ecd8d9a90d198406d2f4e268ed1334c

    SHA1

    beea0ab99c7590f45cdf3d06e6f04a57cf6f3ea3

    SHA256

    745223a12ce796118b1b44c576cada6a9d43f941fc6e5b2235321e3ec8959367

    SHA512

    833ee9b3641a6182fa561d8b1933e24aa359c81c3c48ca18c86c5a45196db45e39d59cc614b18f868e4215f82ede3788235145b1eca58766a0faec4344e8e866

  • C:\Users\Admin\AppData\Local\Temp\8CBF.tmp

    Filesize

    42KB

    MD5

    7b4a703aadb7b55c2c24d048be35e646

    SHA1

    30d5d5c9337a9ae32892bdd9122dde7526f14e7c

    SHA256

    913d40893d4e245acaab80ac5da6dedf40d41504f7ebb37dca925d5a0245f072

    SHA512

    9c88be594853ce44fa172aca258680ce1d6f3cd422a6bc96d9c2edd375d5705fdafa2937d157c731ae003125572848099ffa11f2b6fc3fa8c2b6abffbfbb6c60

  • C:\Windows\AppPatch\svchost.exe

    Filesize

    217KB

    MD5

    47b3a3649d829409b909b289bcfd3416

    SHA1

    06ab95cbeaa0fc200c1573751ccfab0c09671ff3

    SHA256

    7b06abaab828ac58a4e6af70b7702d01fa9cb2eefb7fb96e56f17044eaf3aea0

    SHA512

    356568bbc7d6c490bb46c3b88c93e4036f21045a0e20317eb87f3105feb14d72231943a07bb7dc374d74c03c576ec2813c7844e4acbc9c7725076d8aa98be227

  • memory/1724-1-0x0000000000220000-0x0000000000271000-memory.dmp

    Filesize

    324KB

  • memory/1724-0-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/1724-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1724-17-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1724-16-0x0000000000220000-0x0000000000271000-memory.dmp

    Filesize

    324KB

  • memory/1724-15-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/2400-76-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-68-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-21-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/2400-26-0x0000000001F20000-0x0000000001FC8000-memory.dmp

    Filesize

    672KB

  • memory/2400-32-0x0000000001F20000-0x0000000001FC8000-memory.dmp

    Filesize

    672KB

  • memory/2400-30-0x0000000001F20000-0x0000000001FC8000-memory.dmp

    Filesize

    672KB

  • memory/2400-33-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/2400-28-0x0000000001F20000-0x0000000001FC8000-memory.dmp

    Filesize

    672KB

  • memory/2400-24-0x0000000001F20000-0x0000000001FC8000-memory.dmp

    Filesize

    672KB

  • memory/2400-22-0x0000000001F20000-0x0000000001FC8000-memory.dmp

    Filesize

    672KB

  • memory/2400-34-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-38-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-36-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-41-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-46-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-69-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-84-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-83-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-82-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-81-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-80-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-79-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-77-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-19-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/2400-75-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-74-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-73-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-72-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-71-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-20-0x0000000000400000-0x0000000000589000-memory.dmp

    Filesize

    1.5MB

  • memory/2400-67-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-66-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-65-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-64-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-63-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-62-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-61-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-60-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-59-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-58-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-57-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-56-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-55-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-54-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-53-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-51-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-78-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-50-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-49-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-48-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-70-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-47-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-45-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-44-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-43-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-42-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-40-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB

  • memory/2400-52-0x0000000002540000-0x00000000025F6000-memory.dmp

    Filesize

    728KB