Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24/11/2024, 18:53
General
-
Target
9693fbc2c4be932995f7215ee94ac90a_JaffaCakes118.exe
-
Size
355KB
-
MD5
9693fbc2c4be932995f7215ee94ac90a
-
SHA1
abd9161c00dd769bc4344888d919bb41fe586699
-
SHA256
38132844227c53664db9fb3b76a19634c7b8183d94df793199557688ee9064b1
-
SHA512
fa0741690fc306bd65a2a663bce2d9d3db6851a3dec881743848fcd50c6f236e3a67010cefa621b763ce5ccaf8cb6733218be9126afcd65ac4065c0dbbd96cdb
-
SSDEEP
6144:T3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:gmWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9693fbc2c4be932995f7215ee94ac90a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9693fbc2c4be932995f7215ee94ac90a_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
24KB
MD586faf74a683402953aeab6fdd45d5e83
SHA123b9320a99e2fac070aeebf436171844e8ee04fd
SHA256e430d6f3636630d5ba629b0c9d798ec728349093196b046869b799733f938489
SHA512888b4dd67eb129f1e12dff3d8a37286fc0bf00ae6f47cddfaa0caf0993d217d4839b9fdb7689da6ddc56bc57420a7b65373699baffd5435649dba3fa4d078a7f
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5a5d1c74cab7dfa493da5e55244b7db36
SHA1c4f8a7e774054c9203b29ef5d6ef5238060acb5f
SHA2567e36ac4af8f00582748d5811acc04d89b4cc88bf3fa4989ab3eb65dcebb86574
SHA512f5827a99586e726e9ab15eb510f317350ead519add6d3975280f1577365cdc3cc630684383eda5a99b02580dc51d5e66b7dde333d505d22e203ac50e71df3aca
-
Filesize
61KB
MD570469f3a058eccb03920c87ac941327a
SHA153bca17b448b8147cdbb6fd38a0e706bcca31890
SHA256d3cc46c4143885f25447df428120036343653671800d778cc17c765c180c61bf
SHA51257df44c4e046e2c9ab079b64c3e31769fa2e41309888c10b32fe857529338b4c98240a76e2861299eb2a04e0dbe1f90d6da74458071083253cde7540d9a50dce
-
Filesize
42KB
MD58526ce8521aee323f5c78affde077372
SHA12c9fe31567dc181efd1771103ab35d689a4dda63
SHA256d599be9b8e7258e543245963c2591a58fe5b92ce8cb49064f8a216e846cbce09
SHA512acf905d7207e27b3868789451dd24b88f17c4bca5d2e6b32fbb3b937ad7256cf1c7ebf68e0b0a29e271f516621a8da4cb717a1d87fcd424af922c57acee2592d
-
Filesize
355KB
MD5dafe30869f222454a10da3281b96215b
SHA1d4e3e5d844bb14178415e6e92244ec1b4245fb3e
SHA256a91fe90389f0eb08dcf8ef52d98f053b8e5efa2266c9c78a4c2f10f51c743d5b
SHA51217656b5c3fb420437c94e5172d80bc7f968bebb337eca55fb6066445aff3fc7dbbf58731d4209392201f79dc77f223aa485eed62007b5d76dcf01afe8882b25e
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB