Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 05:15

General

  • Target

    8f56f0585d53134e177154f6e1c054b6_JaffaCakes118.exe

  • Size

    289KB

  • MD5

    8f56f0585d53134e177154f6e1c054b6

  • SHA1

    869bdb3b561a6c1923132d5cc13430e837e9c829

  • SHA256

    86a5cda3bb2780b11ea5969f49a311b95ab33a2686aa4b54e35d866c7011a260

  • SHA512

    ca2ceaa0cf10293ff9a05ad92eac810b90246a5802d30148ed99c8ba1230aa141b06f4e9bf5e98404ce0b729f646668fdc28dbe381f17adc63d0175ab8ec6d6e

  • SSDEEP

    6144:q57G4+6Bxe2KUWoEcWPXNx5UhcVeNG6vRKqM5B732yS9Msh:q5i4+0xEFPXNx5UhcYNuqM5ky1s

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f56f0585d53134e177154f6e1c054b6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8f56f0585d53134e177154f6e1c054b6_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5064-0-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/5064-1-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/5064-2-0x0000000002280000-0x0000000002281000-memory.dmp

    Filesize

    4KB

  • memory/5064-3-0x00000000025F0000-0x00000000026A2000-memory.dmp

    Filesize

    712KB

  • memory/5064-4-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/5064-5-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-7-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-9-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-11-0x00000000026C0000-0x00000000026C1000-memory.dmp

    Filesize

    4KB

  • memory/5064-57-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-61-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-65-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-64-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-63-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-62-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-60-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-59-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-58-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-56-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-66-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-55-0x0000000002950000-0x0000000002A08000-memory.dmp

    Filesize

    736KB

  • memory/5064-134-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/5064-138-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB