Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1312f681be...a8.exe

windows7-x64

10

1312f681be...a8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/12/2024, 19:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1312f681bee858b6bd9249f10192b4472af00f1cd65af9633c40ef0f8e77a5a8.exe

  • Size

    345KB

  • MD5

    88541f6f10f90fd66dfb1e056a1e2a50

  • SHA1

    d97d1814aec111e724aedd88594342b4f9380bd4

  • SHA256

    1312f681bee858b6bd9249f10192b4472af00f1cd65af9633c40ef0f8e77a5a8

  • SHA512

    cdabf02b07a1c535c82b8bf080349000cc3f9ab48bd10edc434fdea86b18b15aee2587adb6b16e7185ca4fdfed21a9dab3d4e5b6d4a6d10c80c7de723aef1c27

  • SSDEEP

    6144:JYCmWoza0a1IMVVEb3uqRpwIUV9lMYmFQqZRRphLuVucfb8ehbjN8wS21bKRTw4W:VmWQa0a1IMVr9eMqbRzLuVucfb8ehbjX

Score
10/10
simdadiscoverypersistencestealertrojan

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Simda family
    simda
  • simda

    Simda is an infostealer written in C++.

    stealertrojansimda
  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 36 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1312f681bee858b6bd9249f10192b4472af00f1cd65af9633c40ef0f8e77a5a8.exe
    "C:\Users\Admin\AppData\Local\Temp\1312f681bee858b6bd9249f10192b4472af00f1cd65af9633c40ef0f8e77a5a8.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Windows Defender\gahyqah.com
    Filesize

    24KB

    MD5

    6d0855b68d397722839da1aed340a154

    SHA1

    4f5f146a814a43676b193665d8a35e96e86f2d06

    SHA256

    55a6649023a5b7898a9ce00483d25adb5b6f80c386511799302f80ab946d173d

    SHA512

    9ae54aef4dd0efed4fbde49f284e6e540613fa8ad5be133387d6a1893311bb159baee0465a8b4c329b7b3866d543efb0aee84b72c9b6ba065a7d7033c8b4c5e3

    Download Submit

  • C:\Program Files (x86)\Windows Defender\galyqaz.com
    Filesize

    41KB

    MD5

    f9db1d322d451a9f1e74c6e482af1bac

    SHA1

    22a63ccd70e4e7b126cebb1b3c30ffb1bd4ecd5f

    SHA256

    e03a189d20acfdc60603c255522c25c4fd08ac3a031a6670831be7eed42a560e

    SHA512

    ca2bf4ed70b55b77822118182d4616dfff9dc90381ba07152935830a3a46961268e6899680ec4fe0e17d23662d6c253eba0071ae6b577f51f96b00eab2b96380

    Download Submit

  • C:\Program Files (x86)\Windows Defender\lyxynyx.com
    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

    Download Submit

  • C:\Program Files (x86)\Windows Defender\puzylyp.com
    Filesize

    61KB

    MD5

    c6dfbbf9f73baf0a558ea7e68a375f27

    SHA1

    e07f5cd2987878f44787fc8a25cd115e3bdf9fa6

    SHA256

    caca74ae403d812ce494a992fb8a074201f492ad5cb4d72b31a8b5cda93b2319

    SHA512

    5ea2485dda6101fc6d9a38c36c6d7e318271b2077f74dce03d02d8c9d3bd3ba4f5bd84df96c2447f652132fe3f3df64010154c4b0c35fbe1c588407b3c004bb4

    Download Submit

  • C:\Program Files (x86)\Windows Defender\qetyhyg.com
    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    cd9f28ae97622591ba935be385124ce0

    SHA1

    1c3776d26ce3007fe2f34e1cce90edbc35c6f9cc

    SHA256

    154563455cdd2dd25055c5e5c2dcb48e1bd8df891cb97f871d98e9a43b8e7a9c

    SHA512

    476a381bd19060ba00a7f171559838d26722a748e3255d29ce9c2304c599b24099bdf6f88ae66b979c79659426d8b191c12490de9d0033486b1c08d37a868db7

    Download Submit

  • C:\Program Files (x86)\Windows Defender\vojyqem.com
    Filesize

    1KB

    MD5

    a8183760dd2f6cbdcebef85ba39daa81

    SHA1

    edec1ca43f7ff31cf1f8256064f5f852551292e3

    SHA256

    c107c0c8f2a0e50138c137dc362e297559a5f33196d832388b7b07ea491229e2

    SHA512

    cba07592601d27b7548e2ef4c5a8d80e697cf1c60d07b883cc7a9e11687e7d0324ab5f97153fda2b3a8a3302689f6b4d909b50bec12de2af5f2c234be0772c61

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HA5FC889\login[1].htm
    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\HOI3BGS3\login[2].htm
    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

    Download Submit

  • C:\Windows\apppatch\svchost.exe
    Filesize

    345KB

    MD5

    155d276b917e795161105f402fe70669

    SHA1

    bd66c30eca0f59d0992df9bd002456de5fec7ef7

    SHA256

    e7a47bb9a545714db7f914946f4d142bbeb7167067b30f2a55ebdb0788fc24dc

    SHA512

    9ee86e40fdc426e75fc8a4d087a69c2ec047a5f25513ad1fcd6109f8902ff4a6142b65a3ccd81fd02ff86677352b2c87163cbb8cc943e3eecb7c5135bae0b9fb

    Download Submit

  • memory/1564-43-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-37-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-72-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-70-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-69-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-68-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-67-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-65-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-64-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-63-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-62-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-61-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-60-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-59-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-58-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-57-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-56-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-55-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-54-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-53-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-52-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-51-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-50-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-49-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-48-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-46-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-45-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-44-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-41-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-42-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-40-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-39-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-38-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-73-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-36-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-35-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-34-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-33-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-32-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-31-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-30-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-29-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-28-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-27-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-26-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-25-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-24-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-23-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-21-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-19-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-18-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-71-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-66-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-47-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-20-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-17-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-315-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-2098-0x0000000007F60000-0x0000000007F61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1564-2097-0x0000000007F50000-0x0000000007F51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1564-2096-0x0000000007F70000-0x0000000007F71000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1564-22-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-16-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-14-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-13-0x00000000035F0000-0x00000000036A2000-memory.dmp

    Filesize

    712KB

    Download

  • memory/1564-10-0x0000000003400000-0x00000000034A4000-memory.dmp

    Filesize

    656KB

    Download

  • memory/1564-2095-0x00000000777E2000-0x00000000777E3000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3496-9-0x0000000000070000-0x00000000000CC000-memory.dmp

    Filesize

    368KB

    Download