Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 13:42

General

  • Target

    7f684be9d9727ab07499a72d9d56f976_JaffaCakes118.exe

  • Size

    243KB

  • MD5

    7f684be9d9727ab07499a72d9d56f976

  • SHA1

    4bed94617a525758c01f2613206cedbfc748a56c

  • SHA256

    7aa922bdbbf7654afb30d30c0f8aeb27c89d615ddb64f98ed6ec6108c5978cdb

  • SHA512

    7d99ba5277263dd5f6c28ec13ade4d1679a50079121b0f20593f7eb7f21bb0762553d36aefd7005f65f098aa293b9146394fcb26dd5a1ea2f4c455ba8f5cf76c

  • SSDEEP

    3072:aulm1rNSRUioV+Jjb+IcCJjvS02lLjzRSU9JLAK3W+wGglJLCRCvOX9QOr:5m8RUDcJ+IcC1H2NzRBLfwGga9h

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f684be9d9727ab07499a72d9d56f976_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7f684be9d9727ab07499a72d9d56f976_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8872.tmp

    Filesize

    1KB

    MD5

    5837b2be0ee78450445491f91b2bfffa

    SHA1

    27af5cfa99874ad70960086efce4c179c4bc1532

    SHA256

    b680ef6988cfd7d9685dced544010da6504bd8441125d97cc01b8a26fff40808

    SHA512

    bd04f804cc9100fb0b48b23dbfbeee50a6a8977a9e3f5bdf3ea4a30a161938e88eaa331f996c9e62c896c7ae7a1cb1014d4eb2ba8e6015de6cdc266eb9695e70

  • memory/2988-0-0x0000000000400000-0x0000000000487000-memory.dmp

    Filesize

    540KB

  • memory/2988-1-0x0000000000660000-0x00000000006B8000-memory.dmp

    Filesize

    352KB

  • memory/2988-2-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2988-4-0x0000000002620000-0x00000000026D4000-memory.dmp

    Filesize

    720KB

  • memory/2988-5-0x0000000000400000-0x0000000000487000-memory.dmp

    Filesize

    540KB

  • memory/2988-6-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-11-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-10-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-8-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-111-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-164-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-163-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-162-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-161-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-160-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-159-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-158-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-156-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-155-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-154-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-153-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-152-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-151-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-150-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-149-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-148-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-147-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-146-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-145-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-144-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-143-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-142-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-140-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-139-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-138-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-137-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-135-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-134-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-132-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-131-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-130-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-128-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-127-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-126-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-125-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-124-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-122-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-123-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-121-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-120-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-119-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-118-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-117-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-116-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-115-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-114-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-112-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-110-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-157-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-141-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-136-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-133-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-129-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-113-0x0000000002820000-0x00000000028E3000-memory.dmp

    Filesize

    780KB

  • memory/2988-256-0x0000000000660000-0x00000000006B8000-memory.dmp

    Filesize

    352KB

  • memory/2988-257-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB