Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 08:12

General

  • Target

    7e70b93bf9fd19f6a2e665d8971da547_JaffaCakes118.exe

  • Size

    243KB

  • MD5

    7e70b93bf9fd19f6a2e665d8971da547

  • SHA1

    3f8fbe5a5ca5f879d8a442c25a91286240e2ad92

  • SHA256

    2c7d4d992a152eff9635979c72893fe47a79c845893d9649258bc46e697d998b

  • SHA512

    01339d3eb4a19e04db208716031e57064ba4adc36fbc44d8c802c8b64f00315de2891761e735bc2c1bd1aaa6ff3d6d1329498a05c9f88e59b91b5c23ebac5411

  • SSDEEP

    3072:9pUznES8pra2nPi8Or85tCZ1GeYhH3xZhaXdg6/0/TAq2qd4EVfJWaRcpz80WQdc:9pUEnZPl5tU1Ge+3xZUpq7dldIwc6Ujg

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e70b93bf9fd19f6a2e665d8971da547_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7e70b93bf9fd19f6a2e665d8971da547_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2488

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2488-0-0x0000000002050000-0x00000000020A6000-memory.dmp

    Filesize

    344KB

  • memory/2488-1-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/2488-11-0x00000000024E0000-0x0000000002592000-memory.dmp

    Filesize

    712KB

  • memory/2488-13-0x00000000024E0000-0x0000000002592000-memory.dmp

    Filesize

    712KB

  • memory/2488-14-0x0000000000400000-0x00000000004E3000-memory.dmp

    Filesize

    908KB

  • memory/2488-9-0x00000000024E0000-0x0000000002592000-memory.dmp

    Filesize

    712KB

  • memory/2488-7-0x00000000024E0000-0x0000000002592000-memory.dmp

    Filesize

    712KB

  • memory/2488-3-0x00000000024E0000-0x0000000002592000-memory.dmp

    Filesize

    712KB

  • memory/2488-5-0x00000000024E0000-0x0000000002592000-memory.dmp

    Filesize

    712KB

  • memory/2488-15-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-19-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-17-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-41-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-42-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-43-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-44-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-45-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-53-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-54-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-52-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-51-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-50-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-49-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-48-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-47-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-46-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-55-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-56-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-57-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-63-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-62-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-61-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-60-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-59-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-58-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-73-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-64-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-65-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-87-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-86-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-85-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-84-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-83-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-82-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-81-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-80-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-79-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-78-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-77-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-76-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-75-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-74-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-72-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-71-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-70-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-69-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-68-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-67-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-66-0x0000000002740000-0x00000000027F8000-memory.dmp

    Filesize

    736KB

  • memory/2488-106-0x0000000002050000-0x00000000020A6000-memory.dmp

    Filesize

    344KB

  • memory/2488-107-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB