Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2024, 20:56

General

  • Target

    7782f8ba4445a38fd5a235e803bcd7bad64dd144a91fb05c21e2e3183c13420c.exe

  • Size

    204KB

  • MD5

    3264405ed24584c06875868107491fce

  • SHA1

    53a6940966e4818249cc5c548e7a5f295522e830

  • SHA256

    7782f8ba4445a38fd5a235e803bcd7bad64dd144a91fb05c21e2e3183c13420c

  • SHA512

    5bc3780438a60736fca0eaf2e265749bc0d3d7cd172b00fbf21bf3563a89a23ba53efc583a35cf15dd43c2c2c5d00c3b53dbc431fc94d0d08ab04dcc76606538

  • SSDEEP

    3072:P5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlAg:PLexkuRaX41xoyJV65gzyZko+uc5

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7782f8ba4445a38fd5a235e803bcd7bad64dd144a91fb05c21e2e3183c13420c.exe
    "C:\Users\Admin\AppData\Local\Temp\7782f8ba4445a38fd5a235e803bcd7bad64dd144a91fb05c21e2e3183c13420c.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2148
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6F75.tmp

    Filesize

    24KB

    MD5

    a79f1b9fc73d37305c88c9aaf2230f45

    SHA1

    6022480d96611eae480ad3c1f27cc95ee18bd24b

    SHA256

    3a271491010939357770ce8d15e7b94ab7a9685183886f98622dd2d0688903f2

    SHA512

    37d04b815803b006280530c9ac1540eacfce8c311c38683cff96b36dbcff249ba53a05926116af72017c21fde1dbd946d4820a9c0969469fda9ad0c08bf035a2

  • C:\Windows\apppatch\svchost.exe

    Filesize

    204KB

    MD5

    46a67fff629a10d522006e0f8655c73a

    SHA1

    50847e1d0ab6e889f45d6719d2ab5bb283dd93e2

    SHA256

    c6cadf832e642e2dd66bc0e4239c9d1b2384c6c118008b126b6fcf9e26a6ac03

    SHA512

    52fe139197ce0317c12bb6a7510723d3b0337640662c7652c0962616c0a107b038130d02a27d233497dc9fe7a8d07fc0a64b1423081c20899d5ecd3944da9500

  • memory/1652-58-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-55-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-18-0x0000000002B40000-0x0000000002BE8000-memory.dmp

    Filesize

    672KB

  • memory/1652-33-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-36-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-39-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-43-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-19-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/1652-20-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-24-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-22-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-26-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-27-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-76-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-79-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-78-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-77-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-75-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-74-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-72-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-71-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-69-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-68-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-66-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-65-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-64-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-63-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-62-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-16-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/1652-61-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-60-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-59-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-12-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/1652-54-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-17-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/1652-56-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-57-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-53-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-52-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-51-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-50-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-48-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-46-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-45-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-44-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-42-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-41-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-40-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-38-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-37-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-35-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-34-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-32-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-31-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-30-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-29-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-28-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-73-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-70-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-67-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-49-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-47-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/1652-25-0x0000000002CF0000-0x0000000002DA6000-memory.dmp

    Filesize

    728KB

  • memory/2148-15-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2148-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2148-1-0x00000000022F0000-0x0000000002341000-memory.dmp

    Filesize

    324KB

  • memory/2148-0-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2148-14-0x00000000022F0000-0x0000000002341000-memory.dmp

    Filesize

    324KB

  • memory/2148-13-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB