Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 11:27

General

  • Target

    407e7b081e99ef4dac6f89f6cf8505c4cd0d27394919c63c21aa6c10645d7469N.exe

  • Size

    218KB

  • MD5

    cce9382abc80ec8bc6b9456607c4dc80

  • SHA1

    8020eba44e1194060dfc3857b2c5f13045194aad

  • SHA256

    407e7b081e99ef4dac6f89f6cf8505c4cd0d27394919c63c21aa6c10645d7469

  • SHA512

    5e98dd8748314aeab74f47bfc9afc2b49bb6c9a4eec3abdfe6a138aeed2eb177677ec1e1ed43bb2e95aaf0f605f1633f9324019086efb011720f797add1be884

  • SSDEEP

    3072:dvm4SZsQrNzPrl6rjGMjp39d4u8iqddCxMIJOb2o5DsBPjim6hwM2H6:R1SyAJp6rjn1gOObn4b6h9h

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\407e7b081e99ef4dac6f89f6cf8505c4cd0d27394919c63c21aa6c10645d7469N.exe
    "C:\Users\Admin\AppData\Local\Temp\407e7b081e99ef4dac6f89f6cf8505c4cd0d27394919c63c21aa6c10645d7469N.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9IEW0KLU\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Temp\5062.tmp

    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

  • C:\Users\Admin\AppData\Local\Temp\61C8.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Users\Admin\AppData\Local\Temp\7DF1.tmp

    Filesize

    61KB

    MD5

    236d2ac22224799b7df4a58eaf9bf2fb

    SHA1

    f42cc131cff85e613175636a76c960949a809306

    SHA256

    0ccfa4873a79db8965438f89c917c8417eb12e486378f9bac604496f29a0d3ef

    SHA512

    c57397d80e69c4858632f42c246cd858665aa7948a162b12a1103fcf7a09e25788d1b545304f05eda006fef5b91919265b30e10081398f86ba0cd26c3c59cdde

  • C:\Users\Admin\AppData\Local\Temp\7E83.tmp

    Filesize

    42KB

    MD5

    da24a3fa958e46d6afb027d16fa38f9d

    SHA1

    cba10917069d772a40670783f874395d7bc34de5

    SHA256

    2c70be18e5ff8473783c43575e5ece8993fe0c850452fc7c21d9492ea21583c8

    SHA512

    3f4d3faeb2830b53f9b043291b2b3121dc65e5ccd5d09b5d4d140ab7f388ebe621f00624db191ccb9cd3a5ff6fd79f2972b744926385df14c6bf8f3645c16bbe

  • C:\Users\Admin\AppData\Local\Temp\9E18.tmp

    Filesize

    1KB

    MD5

    d66124caff4a5c865af583a471403369

    SHA1

    f58d150f458100ae2dd70a9d8edb76ee7b797e4e

    SHA256

    53853381a3acdb16c4e4350643662571b0d2d20072293740b74c9a81a402e32a

    SHA512

    d18392a8e6cda841356450dbf8bc8d5ce7ce7dcc09cf8bb176ef86fe772d147c825567a834449bae6d029e00c1401e4cde9638de8c6b76415a1133d4cad993b3

  • C:\Windows\apppatch\svchost.exe

    Filesize

    218KB

    MD5

    5420727a71effbbd32ea6b37478789e0

    SHA1

    19a7e562e1be5cf3a048efde6936dcbc5a23ca09

    SHA256

    1e4ff5a23fbc17352fa733450f78f00f03d370bf28b9d5dc7e621581504dcdf1

    SHA512

    b2d01aa4dd2141637e25d222a8b3850485098c423d8a5acf1a73d9fa74abf246a68f7cbd28bc6c09e6f5b7820426b2ea8aa70cb1963acb1cfa6bfd3afab61bd0

  • memory/1456-10-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/1456-12-0x00000000022F0000-0x0000000002341000-memory.dmp

    Filesize

    324KB

  • memory/1456-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1456-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1456-0-0x00000000022F0000-0x0000000002341000-memory.dmp

    Filesize

    324KB

  • memory/3848-57-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-51-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-20-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-30-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-33-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-79-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-77-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-76-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-75-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-74-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-73-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-72-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-71-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-70-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-69-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-68-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-67-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-66-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-65-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-64-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-62-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-61-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-60-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-59-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-58-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-18-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-56-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-55-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-54-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-53-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-52-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-22-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-50-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-49-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-48-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-47-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-45-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-44-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-43-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-42-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-41-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-40-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-39-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-38-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-37-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-36-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-35-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-32-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-31-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-29-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-28-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-27-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-26-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-78-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-63-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-24-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-46-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-23-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-17-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/3848-16-0x00000000028D0000-0x0000000002978000-memory.dmp

    Filesize

    672KB

  • memory/3848-15-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/3848-14-0x0000000000400000-0x00000000005AE000-memory.dmp

    Filesize

    1.7MB

  • memory/3848-34-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB

  • memory/3848-25-0x0000000002D00000-0x0000000002DB6000-memory.dmp

    Filesize

    728KB