Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/01/2025, 15:33

General

  • Target

    JaffaCakes118_ee2f5c9525c7fa754674280dcfa98f8e.exe

  • Size

    262KB

  • MD5

    ee2f5c9525c7fa754674280dcfa98f8e

  • SHA1

    e9d3a43f284f063c98f26ea27ff31231a7187d93

  • SHA256

    285dcde29cc3ecf4b71bfad2427e0bd7de33283ff5a920d8ae9e7ac55d5f6727

  • SHA512

    1e1bcabe9bc162a7e8a372508e2bc8fb8889f800a860beb831245270c900adb34cf6714c60060f89bff927878c6075ed6a4afc76954b633f3201a30779b56a4c

  • SSDEEP

    3072:n8nW6fb/CH1pGLP7c7pJ1GE7am88d5Bt9pTlNg8pPD4Cqykp/v35aYV1kOOkSCWc:AWQ6HWLs+Eum1RNrkCqddcGRW4P

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ee2f5c9525c7fa754674280dcfa98f8e.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_ee2f5c9525c7fa754674280dcfa98f8e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2024-0-0x0000000000400000-0x00000000006B2000-memory.dmp

    Filesize

    2.7MB

  • memory/2024-1-0x0000000000340000-0x0000000000398000-memory.dmp

    Filesize

    352KB

  • memory/2024-2-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2024-3-0x00000000002E0000-0x00000000002E1000-memory.dmp

    Filesize

    4KB

  • memory/2024-4-0x0000000002630000-0x00000000026E2000-memory.dmp

    Filesize

    712KB

  • memory/2024-6-0x0000000002630000-0x00000000026E2000-memory.dmp

    Filesize

    712KB

  • memory/2024-8-0x0000000002630000-0x00000000026E2000-memory.dmp

    Filesize

    712KB

  • memory/2024-14-0x0000000002630000-0x00000000026E2000-memory.dmp

    Filesize

    712KB

  • memory/2024-15-0x0000000000400000-0x00000000006B2000-memory.dmp

    Filesize

    2.7MB

  • memory/2024-12-0x0000000002630000-0x00000000026E2000-memory.dmp

    Filesize

    712KB

  • memory/2024-10-0x0000000002630000-0x00000000026E2000-memory.dmp

    Filesize

    712KB

  • memory/2024-16-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-18-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-21-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-20-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-42-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-46-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-51-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-43-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-44-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-70-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-45-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-47-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-48-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-49-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-50-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-71-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-86-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-85-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-84-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-83-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-82-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-81-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-80-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-79-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-78-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-77-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-76-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-75-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-74-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-73-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-72-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-69-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-68-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-67-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-66-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-65-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-64-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-63-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-62-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-61-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-60-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-59-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-58-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-57-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-56-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-55-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-54-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-53-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-52-0x00000000027F0000-0x00000000028A8000-memory.dmp

    Filesize

    736KB

  • memory/2024-121-0x0000000000340000-0x0000000000398000-memory.dmp

    Filesize

    352KB

  • memory/2024-122-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB