Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
28/10/2024, 16:26
General
-
Target
7a6b2fa63b0e66ee42b94427b725a29b_JaffaCakes118.exe
-
Size
241KB
-
MD5
7a6b2fa63b0e66ee42b94427b725a29b
-
SHA1
4227c7b283a1b35a9b2a8e037eb8097194cbb59f
-
SHA256
e5bcfb21ecb64d3ecc6fd5b043461a0d4b22bf59fea6249868f1fc6b6f84e039
-
SHA512
9eb011dfaf3d30b8e27a98671021422c931238f122dc6b6086831d9fbec5ceb4a5a27cdf452b372803e664b6b2752c6853dfc6a6f947167c87445fcc5fffd323
-
SSDEEP
6144:qsY7cf92DU4H9nBn4hbbuVyUWYgH4Va5X3g4sVs:qSFufH1BnOPuPM4OX3gts
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a6b2fa63b0e66ee42b94427b725a29b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7a6b2fa63b0e66ee42b94427b725a29b_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD590c46aee6e3c7269d5941bccc1eaa058
SHA1a25ef2961cde4920a42ae8575fff945eded9ae6b
SHA256725ac2972e2f74fba826a3288f4faa63831c6f4c7a7f3d429b10ce5e27384801
SHA512190bacb2df862334acfb5c288886a3972246f668b882aaf7ab3f0c8a5d9680517c0759b1dcd691db5f2ee227a7ab0930594d32bfe3691998d10401271201631b
-
Filesize
24KB
MD536c96a4003ebd59c7741351d46f76025
SHA1378503663c969c607be0e52b4fe8767f85f25c33
SHA2562e6c95858b06835efb36920fc5d462183f8ded17eed99c193fe9f4d9a3c550b5
SHA512156b077ed08c6a7f1daabbb30cd33fabb35b035a01588aea203677de516e87f3a2fcc7222891e81a4e16d67baccbe82e47c3570acd0f283ca346589d17deb7b9
-
Filesize
1KB
MD5ab0928911771e6810e9c2b6d1e1364e6
SHA1c428f2c67b931a91be5af6309461dadb0e9da8e1
SHA25678f72d24c48d8b06a70e08d7552252168ca3918748a6755ca08980cd2d3b283e
SHA5120f88ee35b24e2e96461bcbcaed551ceab63ea67931909b52270e7832996cc5c541363dc734ea321fc65fb3638239563cf277e444d652895879c0ae88bf1f7a8c
-
Filesize
2.0MB
-
Filesize
352KB
-
Filesize
400KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
2.0MB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
352KB
-
Filesize
400KB