Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24/11/2024, 18:53
General
-
Target
9693fbc2c4be932995f7215ee94ac90a_JaffaCakes118.exe
-
Size
355KB
-
MD5
9693fbc2c4be932995f7215ee94ac90a
-
SHA1
abd9161c00dd769bc4344888d919bb41fe586699
-
SHA256
38132844227c53664db9fb3b76a19634c7b8183d94df793199557688ee9064b1
-
SHA512
fa0741690fc306bd65a2a663bce2d9d3db6851a3dec881743848fcd50c6f236e3a67010cefa621b763ce5ccaf8cb6733218be9126afcd65ac4065c0dbbd96cdb
-
SSDEEP
6144:T3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:gmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9693fbc2c4be932995f7215ee94ac90a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9693fbc2c4be932995f7215ee94ac90a_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53c374a3ff2e877692384cf5e486f8a77
SHA18f838ea24906c34ab23f6d97804913bd9434f231
SHA25698754d8696014e9c60fec036f41442fedb5b0391a6a2e4cb6e6865a89cc2599f
SHA51206dfe51a84481449223b57a54f7498434b390b5216cd6bba2b734788a7ac1a112bd8b0321e70464becbb201f0c09f94893bed32ca0c8281f63493eb74b90a0be
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD55f787302c9cdaf12e1b2ad52f38ba7f6
SHA17040878ad4e2baec7ba02fda714f8bedfa3694c8
SHA256ab734f3c8b1ea57dc5bb393933b8b13d31c992a8e885255777080c62cdd71585
SHA512aee0972a7bb507a05ac124468ae88b5c02fe480aa8af564f35005ff5efdb4a4fc500b1ddd0642163cc9f7a3121463bc1766d61988465374e95fe00c7c8a8ab66
-
Filesize
355KB
MD5aa0cde0b69bdb9d998701c6af7e7365b
SHA10bc541dcc9c9a87643df953bf5bf3d6ebcb4412a
SHA256f11787e7d291cb38136360ac62650c4f3acb092c34ec30d6a7cf128aa211b430
SHA5120c43887b39953a30d104d5a245759df06680c66b8b186b8f4a078c1c786e3638bbec892ae919fcdf65a8d6acc089183eefa4aead98c9fb090f15bf0c6e168f6b
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB