Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/01/2025, 06:51

General

  • Target

    4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81.exe

  • Size

    204KB

  • MD5

    d3c77a58622b1f3ae3cc1e73b9a6c01b

  • SHA1

    bbd5b6544ee69fe5f5320a4e32275b98d3c5b7cd

  • SHA256

    4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81

  • SHA512

    bebb23ed8370439d1de965ed6ae7f8bf6aa2235e8025a35b50447876ad32e56e3a7b29b00b16a01a2e6ce47f56d5a29c9c195ecf8e14c78febe4b6d29fbb3e5e

  • SSDEEP

    3072:S5u7yT4TVbkuRaX1w71jnRkCoyJTarYWbV+HOFxg+z1WxJsqWkoyjOowUVl/TlA4:SLexkuRaX41xoyJV65gzyZko+uc7

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81.exe
    "C:\Users\Admin\AppData\Local\Temp\4da97776632cdb603b6ab557f03747f9fe6661473942156adfb07caef3650f81.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3204
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Modifies WinLogon
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3DWZNJ32\login[5].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Users\Admin\AppData\Local\Temp\1744.tmp

    Filesize

    61KB

    MD5

    6bae4988f336a6eff17fd51729ff69c0

    SHA1

    12b8e6ced20518f4c729e8c9bb9373650e79f591

    SHA256

    c9f1dc2f184a931675ca6624a46fb5301f2fd08297f99310ebbf586e05691adf

    SHA512

    c39da92116a50ee74187be06d2868d145047003a7e401d83867687e16ee70e686b4555adf14f6bc25582195d5c1d437c3fb62616f308cb3a4b9834ac6945af3b

  • C:\Users\Admin\AppData\Local\Temp\35.tmp

    Filesize

    593B

    MD5

    926512864979bc27cf187f1de3f57aff

    SHA1

    acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

    SHA256

    b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

    SHA512

    f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

  • C:\Windows\apppatch\svchost.exe

    Filesize

    204KB

    MD5

    6f7c4979333cfca14a9b8f790308be7c

    SHA1

    7c3d95bc4f9c26bf92405f453dde088aefaec15a

    SHA256

    df4bcc4708cecb4c4b1883b3fb2ab567300a8af6696920779d17e6386a2ab2f8

    SHA512

    efab8c221fe9cc43bdecd2c830908135baee118a2422532fe98ec999bd4fec6d3e6bcb1f52e4a1e8990ad40216982e5808d275b3322af07206fc582240830b59

  • memory/2476-58-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-57-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-12-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2476-13-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2476-17-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2476-19-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2476-20-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-24-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-22-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-26-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-32-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-79-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-78-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-77-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-75-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-74-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-73-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-72-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-71-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-70-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-69-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-68-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-67-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-66-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-65-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-64-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-63-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-54-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-62-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-61-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-60-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-59-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-18-0x0000000002AB0000-0x0000000002B58000-memory.dmp

    Filesize

    672KB

  • memory/2476-51-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-25-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-53-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-56-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-52-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-50-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-49-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-48-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-47-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-46-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-45-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-44-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-43-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-42-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-41-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-40-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-39-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-38-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-37-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-36-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-35-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-34-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-33-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-31-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-30-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-29-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-28-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-27-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-76-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/2476-55-0x0000000002CA0000-0x0000000002D56000-memory.dmp

    Filesize

    728KB

  • memory/3204-0-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/3204-16-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3204-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3204-1-0x0000000000830000-0x0000000000881000-memory.dmp

    Filesize

    324KB

  • memory/3204-15-0x0000000000830000-0x0000000000881000-memory.dmp

    Filesize

    324KB

  • memory/3204-14-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB