Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/11/2024, 22:41
General
-
Target
9110e0d76003ecfa7730be005b3a53a0_JaffaCakes118.exe
-
Size
356KB
-
MD5
9110e0d76003ecfa7730be005b3a53a0
-
SHA1
c735eda4c273ced78d11e0e55603e970d230b636
-
SHA256
6829e097d6de8178d81fc4880543e9dd0311dfe3fe26bddc3c724f8757f6c536
-
SHA512
72d2a2ec6ff95b2e1cbac64947ff3e00dfcf838a15b10b89f430823a08c254e4c7b1cb0fe2423b33c04354043c3ca91554356d0dbb50b54e02fe6f343ca66872
-
SSDEEP
6144:z3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9Ei:AmWhND9yJz+b1FcMLmp2ATTSsd
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9110e0d76003ecfa7730be005b3a53a0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9110e0d76003ecfa7730be005b3a53a0_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5e5111ed4015cd8c50583d16604b91873
SHA1121687fb87eda6be0b48a4105f9aeeb66e0333b3
SHA256a823005a3fc6772851e5bbab07327fd0d398d1e31a7be897e0761317d767efed
SHA5129dc88d017e1968ec0c438cde22f3596b51c695fc99539d9daff4d40f601c7b22819873325efc7d0f1cfa42b68c4d829715438a91d1e279e3a999b077b18e0cb0
-
Filesize
61KB
MD53ae2c7fe9bb1f96cb7853f1731a89036
SHA1d4bfabe9b386d3bd3fa21a1ba31c1bc3dccc1e5a
SHA256a4140d6fa692b4b4b1a98bd247b3a3bf80b67a819a62d96b8215e7d5e6f54181
SHA5128aa03c3ade959fc6cf432364c983b38ef5696b87e66e4ab4a577f5ec3696f718ab00fcca0e9c3b8ea2bf0e34d255abd7e66f48df998c430a5da8a39fe445169a
-
Filesize
1KB
MD5bf56fc34ceb3e8b4ea43a77de73b57a4
SHA112f4b9b1c6f0b3a3f4f6e01a63b73168809f178c
SHA256b8cb981c3d9627c7e381ff196d972f5ed5044f1a8e4c154541adf558dd903c50
SHA5127f3c3672c07acb0beb4b24a03599f12b27d091097e80d661999bd68ad3c759f835b3bf2d110914cabf06ee8cb3622f2b171acaa927ed70b7aff6930f9b9f8cb4
-
Filesize
61KB
MD522fe9c951e7f8199c0ddf001fb5f7c4c
SHA1f5eb138e517671391e80e6ce23fd8b1f47803ae0
SHA256e0cf4351614a505a2607b61428f2bc06ee48126588c0bf5fcf1c4211041118e4
SHA5124b656bb60625f81bb1a100a3e2150ae7c8021765390221c41042552bbf7cafcedad58b870cb17ef1226595ce1d9a1c73fcc1a74f75f4bcf1a2a5717b3298689e
-
Filesize
42KB
MD5aaa933c9180c391896d681a8ff73cb44
SHA16c0d15be904e1c4ecc87b63c61d61ee1e96a4a94
SHA2562ea49805afac512e0724f7540a578194343b3bc75c45feaf63dc60082f6417ac
SHA51250e0b8de82b272413b0c5ccf833ff3c331f8aa994345d7859d6387c8cde0e7c8291fe905922a7883c2db09dd6a7da745456f96c523ec9c8e89ad53c708866d1c
-
Filesize
42KB
MD5e59a18e1c8f0bd78dd3de7ace892b66b
SHA1a5dce09ae37318da18ef189ca4f9c7923a1bc847
SHA256da1b9c8434f55ab74cd022c39a986249a8646f76510ee2eb65c55e29162f4ee8
SHA5120b664c840e8f1d6dc2fc9c60edeff8d3c39ea730bae1215eff4441fc5d8b07e25b8609ee07dfd82662930747508a6da2d71277ab0811d9eaef8e8ca7b2cd84a8
-
Filesize
24KB
MD528940fb1dc1aa0fc98b3d7419a57a2cc
SHA18e6f47f79a61427ce867637b13e21ebbbf5e56a2
SHA2560bc7562b376893a4227cacc6fbc04cf516a95dc15f9b3ac0eb7234fda5c1c9f0
SHA51241dc3a714126605f10fa896ccbba9d90433f70c739d437a4d536569a277145a2e4556eb845b7d3fb9255f55577e685e518e948420df95b30034ae1cdcaecfbd3
-
Filesize
356KB
MD5ca73a283447dcb50c0ffec2cd18c058c
SHA11b6e9d4fc79db68365094d5bbeeb20f0bc7eae5a
SHA25690ccdaaa83988def61a5f0b8f27608f5d2d359fd83caf795827d777e1b3d0747
SHA512e6c4771a5caed5d7ba264c3caaf472c86104499c1ce8fd3cfd7f9846182cea758b20e52a128e93fdaf231cd206ec566a6a36eb1323e316247029199c8fe538b7
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB