Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2025, 00:06

General

  • Target

    99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39bN.exe

  • Size

    355KB

  • MD5

    a03e9c3d53132e9d5fb94bc1f9d0e110

  • SHA1

    7ef9a622ef0b708d66e4e32954859629e8319010

  • SHA256

    99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39b

  • SHA512

    6db79038f42a80c23f9b98683785c993fdc2473e189008ea2c75ca5bbfd15cf1a5fbb65a5557617db435519ef67cfd92070f51839a47fc45e64e5ec86e638cb7

  • SSDEEP

    6144:Y3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:jmWhND9yJz+b1FcMLmp2ATTSsdS

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39bN.exe
    "C:\Users\Admin\AppData\Local\Temp\99e5651cd4df9486152f0868a4f77d97caddf89ebc3c9e1e170a9777384ab39bN.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5707.tmp

    Filesize

    24KB

    MD5

    103638106cebc206f0288f5c3f65082f

    SHA1

    bf3f40b28ea3127456fd769feec91bbf7f6100c1

    SHA256

    8d77bca06a9334c595fb3c56e8ee2e77d49cc7f4725e91022d20aea5f727ab99

    SHA512

    04f8e219c2b355c80283e1324fd548b62b4416d68713e29dc23bf6a8dc870c97a0a13272fe59b071bb6f9c28312db64b50e7c0c1da28e84319c4c8615cebb5ae

  • C:\Users\Admin\AppData\Local\Temp\576B.tmp

    Filesize

    42KB

    MD5

    c8742af6398c2c0fda8132c4a7843699

    SHA1

    5f4a2793e1b49c11d11b0476d17ecb9939826990

    SHA256

    ffdbb6ca2fe426d63bb5e9f274436c6803f55cf6d9edb7fc6f1e6c193a945753

    SHA512

    cb006ae52bbcb59def80101744d44b52f47b7ad2b96c62907efad0899e7f09f9b393e56666f1ff30c2fc7b56e3d14967a0bcee673ad60b7d764ef22620b55686

  • C:\Users\Admin\AppData\Local\Temp\A40F.tmp

    Filesize

    12KB

    MD5

    caa300673c11a7627a7b6346e1a93b61

    SHA1

    7ecaf36f1e150c478b6cfc3446ec7f0c662c071a

    SHA256

    42ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa

    SHA512

    f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6

  • \Windows\AppPatch\svchost.exe

    Filesize

    355KB

    MD5

    d825b303eba53bfa7ce0fd98aa662740

    SHA1

    3fb4f98f6c348d35ed5d1fcdaf96ec168e548e6f

    SHA256

    050907dd5b45ec372446c40c6de5db45906d211acfed9bf56a33b3aad9734c4e

    SHA512

    85985f7741e1a7eb9e84e15ab5067634198f48e217341c5e21782e6143ec9555da5bbcb9dedf8322fb72ef6f482fa73c386e734802c881f0637775737d1a3942

  • memory/2392-13-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2752-16-0x00000000002A0000-0x0000000000348000-memory.dmp

    Filesize

    672KB

  • memory/2752-20-0x00000000002A0000-0x0000000000348000-memory.dmp

    Filesize

    672KB

  • memory/2752-24-0x00000000002A0000-0x0000000000348000-memory.dmp

    Filesize

    672KB

  • memory/2752-22-0x00000000002A0000-0x0000000000348000-memory.dmp

    Filesize

    672KB

  • memory/2752-18-0x00000000002A0000-0x0000000000348000-memory.dmp

    Filesize

    672KB

  • memory/2752-14-0x00000000002A0000-0x0000000000348000-memory.dmp

    Filesize

    672KB

  • memory/2752-27-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-30-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-28-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-32-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-36-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-58-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-79-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-77-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-76-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-75-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-74-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-73-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-72-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-71-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-70-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-69-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-68-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-67-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-66-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-65-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-64-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-62-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-61-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-60-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-59-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-57-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-56-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-55-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-54-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-53-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-52-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-51-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-50-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-48-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-47-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-46-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-45-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-44-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-43-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-42-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-41-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-63-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-40-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-39-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-37-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-35-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-49-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-34-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-33-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-38-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB

  • memory/2752-192-0x0000000002430000-0x00000000024E6000-memory.dmp

    Filesize

    728KB