Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 03:01

General

  • Target

    3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6N.exe

  • Size

    375KB

  • MD5

    9816fb0d328251b476f467a22a1b32a0

  • SHA1

    25d032c3bd8e1987e2e052b45cd91cb072c1f019

  • SHA256

    3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6

  • SHA512

    d4c276a666b7959d3844cc9f05e58e99e045c14d78ff8bbf1a63a15fd7ba080e472b5d4dc2a00cc22a8c4722c6df5e48ca84dfc2f2d8c5827c8c6df4c70bca77

  • SSDEEP

    6144:R3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiU:WmWhND9yJz+b1FcMLmp2ATTSsdU

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6N.exe
    "C:\Users\Admin\AppData\Local\Temp\3c318e328acb1a3b02a81899e048886543e87c36e94b91f060c51ea18754c4c6N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\700F.tmp

    Filesize

    1KB

    MD5

    ee4f9eddbd7ac294cf509d59d179b853

    SHA1

    2c939fbd48970bc71fb02995ccd68fd4a4a80945

    SHA256

    0a535efb31b7a8bcad26cf0584a29c4d223bc16bc0a654734f2e6d8143535dd1

    SHA512

    adb8a7972141d43f243ed2e801d7f38dec0a9ff2b2ebf4e28319ba2b4acc91f12f5b1212d4753ae335d566684d7b7f55086487aad967a173768f58eb2b4528ee

  • C:\Users\Admin\AppData\Local\Temp\CA27.tmp

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Temp\CA27.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\D853.tmp

    Filesize

    1KB

    MD5

    c938f856d787eb3ca9ce1aabf5295ab9

    SHA1

    b4bbee3bc483fb6a90799c49e3e55a7fbc9e37c0

    SHA256

    a10b94891bf653af623c6b20ffd3eff698a6f8965cb77fb20456b884670f0188

    SHA512

    1bfc1f1ff7289a6345184d65c80d503cb47c04196714a2c8cff37bc07f4e5b2e7413fa6e140919f132f372892181eb94a35edbccc3e24c3ad0035c366189e5b2

  • C:\Users\Admin\AppData\Local\Temp\D887.tmp

    Filesize

    61KB

    MD5

    abe17504331970f8825b181a50cbb770

    SHA1

    3db51c80f608ce9ab24b8cfee4b73b801c2f99da

    SHA256

    2229ef1de246d793411e5af0cc440990c623d6a1c3e87e4cbe3d7885470cd2aa

    SHA512

    82b6c49793bbffc5fc1665d70204ba678e6c1f33077c79fa3042b572e22687e8155a4b5cf39f576f98bfa2cb56ca8374644055b03750913d30bb9cc80d3387cd

  • C:\Users\Admin\AppData\Local\Temp\D8FB.tmp

    Filesize

    42KB

    MD5

    8d2b72d48de4a91ea681038a91a56c53

    SHA1

    b072cd9ca058072f3a3aedc951af4911edc1ae2c

    SHA256

    b93ca7b017182128ff5fc667662e6b4bbc407ca96c8223fd5033e4021be4cc51

    SHA512

    7376a8456f0f4dffc9efe00e1295ca6206c030f3fe91321b950e0aacff8dde6bd478ae2edf624737bfc3b72fad008b08d3dd560cdf5e16e3b8a8dcfc0c1bfe91

  • C:\Users\Admin\AppData\Local\Temp\D8FB.tmp

    Filesize

    42KB

    MD5

    1278aec10cd3964c906c7fe7c0276963

    SHA1

    4c761587ea5b6a213574e2630cdbce5c3555e4ac

    SHA256

    5f847bf710aaf23fa5a357d3a64f1f7d2719f329dcaab052767463036b4b647a

    SHA512

    56b576b8ef3c367aa21cec589cedc2ea5369767e8967a0d37487b97a141526d56c1e796d555dcec1725b8064dac01b813509b54a32a53466e56cabffb0bc7417

  • C:\Windows\apppatch\svchost.exe

    Filesize

    375KB

    MD5

    ac3f123a88253b0138fe719f02ad25ca

    SHA1

    ee73d9f9887a834f321001c34a421c797fcec6ac

    SHA256

    690bffcd5c09261a3ccd268599cf8c605a38a3dfb157869126748cbf30630c0b

    SHA512

    6bcab28b199a93a1a8d0ec059eb3d4b978b160630957a2aabdba3eede6834e7c10f8aa93606a39a71f9b5f4c7cb6913d2ca8d0d19f836a06e281365879e2c0da

  • memory/1712-50-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-45-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-47-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-21-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-20-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-31-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-76-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-75-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-74-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-73-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-72-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-71-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-70-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-68-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-67-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-66-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-65-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-64-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-63-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-62-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-61-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-60-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-59-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-58-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-56-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-54-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-55-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-53-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-28-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-52-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-51-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-48-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-25-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-27-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-36-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-43-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-42-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-41-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-39-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-37-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-38-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-44-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-34-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-33-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-32-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-30-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-29-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-26-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-24-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-23-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-22-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-69-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-57-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-49-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-46-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-40-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-35-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-180-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1712-16-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-17-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-19-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/1712-13-0x0000000002730000-0x00000000027D8000-memory.dmp

    Filesize

    672KB

  • memory/1712-9-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1712-181-0x0000000002B40000-0x0000000002BF6000-memory.dmp

    Filesize

    728KB

  • memory/3444-0-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/3444-11-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB