Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 19:39

General

  • Target

    ec0e82b537c024dea6b51cf8deda24dc_JaffaCakes118.exe

  • Size

    253KB

  • MD5

    ec0e82b537c024dea6b51cf8deda24dc

  • SHA1

    4cbd554ce7ee0ae4b439c19640a120811ef80449

  • SHA256

    008d68bd8c0ef4f7ef4f6e875f50b5efbed9ab73a6a00fcd019ec1d429f1f76e

  • SHA512

    472427a8c4a647cd575d438209b28a3503ffa48bfc6d949df6e695c18158d0ee5eb7a5850dd785345644e8f3f3f57625c1b182e0be616e153a50bf4a04cece93

  • SSDEEP

    6144:Ej89h36jLTfrPXGxxkDal4jZUNesLT91omGSSG4u2WOMNOsPaU7:vyTjOxa0+ZdsLTLGJC2WNYrU7

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec0e82b537c024dea6b51cf8deda24dc_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ec0e82b537c024dea6b51cf8deda24dc_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3024

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3024-0-0x0000000002690000-0x00000000026F2000-memory.dmp

          Filesize

          392KB

        • memory/3024-1-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/3024-2-0x0000000000B10000-0x0000000000B11000-memory.dmp

          Filesize

          4KB

        • memory/3024-3-0x0000000002710000-0x00000000027C2000-memory.dmp

          Filesize

          712KB

        • memory/3024-4-0x0000000000400000-0x0000000000507000-memory.dmp

          Filesize

          1.0MB

        • memory/3024-5-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-7-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-9-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-63-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-65-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-64-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-91-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-89-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-97-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-118-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-117-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-115-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-114-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-112-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-110-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-108-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-109-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-107-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-106-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-104-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-103-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-101-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-100-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-98-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-96-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-95-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-94-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-93-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-92-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-116-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-113-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-111-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-105-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-102-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-99-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-88-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-87-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-85-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-84-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-82-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-81-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-79-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-77-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-75-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-74-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-73-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-72-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-71-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-70-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-69-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-68-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-67-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-90-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-86-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-83-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-80-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-78-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-76-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-66-0x0000000002990000-0x0000000002A48000-memory.dmp

          Filesize

          736KB

        • memory/3024-190-0x0000000002690000-0x00000000026F2000-memory.dmp

          Filesize

          392KB

        • memory/3024-192-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB