Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 06:42

General

  • Target

    a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267N.exe

  • Size

    208KB

  • MD5

    252b25e9d5964133888342b0b269b020

  • SHA1

    b79252c8fcb3a6c94fd520b666f4cbb219b57f6e

  • SHA256

    a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267

  • SHA512

    f666a9d9f960caad2aa7c1d7c46b800f42d939d58ae1fafa193e60af5e672ba94bb4951197ea2ade5ffc42358ec456c3b79e8af73e03dc11fcea50ac4b8cd0cf

  • SSDEEP

    6144:uOYX27lPBA3YDMw4lj6idlMlwl7/79C87:uwBAy0rlMI5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267N.exe
    "C:\Users\Admin\AppData\Local\Temp\a53c5f84bbf7bf143a61a107e550b7b33e74953341cb5fe42aefbe96dee88267N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XH3Z2ZON\login[1].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Users\Admin\AppData\Local\Temp\8416.tmp

    Filesize

    24KB

    MD5

    3c84adbb78edab2ff49e62abb08dc0d8

    SHA1

    cf652e42554fae552c7301d3e1ebaf870ef0ca38

    SHA256

    be1a7790338b1c448502d351c53536890066d8cfee80162150b38fae900b65e9

    SHA512

    96dc3da0d7cd5853cd627762373b944afabace5b00652d9831e6b175db48782191124a0fa630b5b76cefa62da4a8fad2444dadaecdf652dea5f19075fa905d21

  • C:\Users\Admin\AppData\Local\Temp\DD04.tmp

    Filesize

    593B

    MD5

    3b03d93d3487806337b5c6443ce7a62d

    SHA1

    93a7a790bb6348606cbdaf5daeaaf4ea8cf731d0

    SHA256

    7392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30

    SHA512

    770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88

  • C:\Users\Admin\AppData\Local\Temp\DD04.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\EAC3.tmp

    Filesize

    61KB

    MD5

    bfd2cf627c818f6cc11ef92f7add305a

    SHA1

    3582395fd51a4a06501ad2e59152f3535fa04248

    SHA256

    7a02c54dd96ccb0aa6d80c5d814eb0f6f782da2894fa6f1fb9ffb6a4d4c3dde1

    SHA512

    9308b859c4d588b686de6c40c4ddbd2e3decd6ce1e4c93b264331d12eb4a3154dd22bd5e52ad204da627aee03220f2600dea6b52611498c57329449a5e9aebab

  • C:\Windows\apppatch\svchost.exe

    Filesize

    208KB

    MD5

    044e94cc064d7cbe5e66fd2a6c059ecf

    SHA1

    ff6adee6f16c508c65efd6191cd3c571cc06305a

    SHA256

    3ed07b45a12c5ca2030e912a826cf6142919bb52ee06ca20d706ce821d595bf1

    SHA512

    26d09ae5202505e675acea56d24251f49e7ae93d6df37a59a75896d222314f2b0b9f3c6cca1e7903d8787952432166c71fb60ccab0835e8167f13cecd4c09789

  • memory/1824-59-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-56-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-19-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1824-20-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-22-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-24-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-68-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-64-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-51-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-38-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-32-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-26-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-79-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-78-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-77-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-76-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-75-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-74-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-73-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-72-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-71-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-70-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-69-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-67-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-66-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-65-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-63-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-62-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-61-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-60-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-13-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1824-58-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-57-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-53-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-12-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1824-54-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-55-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-52-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-50-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-48-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-49-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-47-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-46-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-45-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-44-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-43-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-42-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-41-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-40-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-39-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-37-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-36-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-35-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-34-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-33-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-31-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-27-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-30-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-29-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-28-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-25-0x0000000002BF0000-0x0000000002CA6000-memory.dmp

    Filesize

    728KB

  • memory/1824-17-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/1824-18-0x0000000002A00000-0x0000000002AA8000-memory.dmp

    Filesize

    672KB

  • memory/2688-0-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/2688-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2688-1-0x0000000002210000-0x0000000002261000-memory.dmp

    Filesize

    324KB

  • memory/2688-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2688-14-0x0000000000400000-0x00000000004C7000-memory.dmp

    Filesize

    796KB

  • memory/2688-15-0x0000000002210000-0x0000000002261000-memory.dmp

    Filesize

    324KB