Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01/11/2024, 16:23
General
-
Target
8484d10abeca30859d1c28090c094685_JaffaCakes118.exe
-
Size
355KB
-
MD5
8484d10abeca30859d1c28090c094685
-
SHA1
a9fcb9c45d665f6358ecf0ce9b1a84b112ea1975
-
SHA256
aa1ff7edc4fcda184bdbd389e34d3926544d7c24bdb3b63c938c97ce92a29849
-
SHA512
4aa98c98da046f29469b79e29418a2b4a6cf9062ea6396074f5f9ddc238663ba09ee9fcedf73b3b31f3f343ea3c23c3ec7ed5f0d1cb9724279df7a231558cf9f
-
SSDEEP
6144:z3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:AmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8484d10abeca30859d1c28090c094685_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8484d10abeca30859d1c28090c094685_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5fc4080827390749f8dd1f9c2dd51a682
SHA1c8b2bc0c9bb91fa1f6f0627f2fff6d9a4b460205
SHA256162a95baa190e167ea78ed585117bed14c9975ba1caa09e7d64c886d68973025
SHA512491b3acfde3ff1ff41b3d9e1810f4c4b778de0bd67841755c4ec6ec8e1dd1e888bfd13f31fa448cf5524f6ae3f6e0bc0a632f8fd0a80eca53dd5433afcf94714
-
Filesize
355KB
MD5d2130dd68d088c4caf8cc96b7441313c
SHA1c21924e19a821f2044ac704d640da85c73dca96d
SHA256082d4d2f6a45a9962c36dbf2ed1d2b0edc8105918bdef75ce40b2f7962859157
SHA5126fd30b60048cbff1e11640babdfce8c7655f853920b78e8792b022cd208a53d8ed3f2ff635ef8047d0cc0dace567e7f9d5d7fc40d3afa2f3b728757cc282bcfb
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB