Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-11-2024 04:36
General
-
Target
aeee782855b939a2729bf6d8cc9c78a4_JaffaCakes118.exe
-
Size
234KB
-
MD5
aeee782855b939a2729bf6d8cc9c78a4
-
SHA1
edac19fba183c3d6a711384d0fddce2f9bb38a61
-
SHA256
ce79d22dbf8ece3630a19366c5defba25d477f30014a2c3d9c9d61b2402a17fc
-
SHA512
343d70c554ac3ab05dde3937627d04cdb27cb1620ca4bda9ad70e65563b22a783d378b4cafbdd55108acf4bc3d6d73af5b0b548a06317570457c9a8e710bc454
-
SSDEEP
6144:5TS8VSGlw+ukxjxYVpp6uTT53oV6JTtgOs:I+SXbhVjPq0Xs
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeee782855b939a2729bf6d8cc9c78a4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\aeee782855b939a2729bf6d8cc9c78a4_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
1KB
MD537dc134a776080f217b7b74475c6cbe6
SHA1da12de20b7e51725fca29810c2cdc21c5d19f532
SHA256956c3058e17ae8e9fc3491be1c449b0561a68960eecae4dd20ca09c30a8cda05
SHA512dfe2c79a1382c0f1188d7a98b4722dd906db73bb58374a852e45aad7bda937c262be3ba584eef6700c595da5c2321cad2220b46b63913d601171b10ffb3ff98f
-
Filesize
481B
MD5b91c3432f2143223f1db8addc1c876fe
SHA140a667195c76425b639407f6d65043fd6fb62956
SHA25620ea1549c13cccc0d7f83220394df0922aa01426cadfb4d722fb86fc1d352de3
SHA51268a6a47142b8a9124e839949c316a6c5b3b158850f301ce9c542e00b782e53e8d5ac7c6de2f096198315c726f734898e46c3d7998124568924676dec77aec2ed
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD51be5b63f236642005a042c45f98e9209
SHA1340d211c880d8af34f62e45801d8c068c7cd5439
SHA256b4ca9889225596bfd71ea2c434c2067aa838d5703c2f017d49b33979a93fa4e5
SHA512a5c5685133848b43b5d596c2840e727c6bc5bf5ca2b53e175f9770a64e1e0324b0df7bdddb664cc685ec436e7898c50d73d44ba24c3fb29fe0d986724a781721
-
Filesize
42KB
MD50c95d98628719618803da2ceee08ca95
SHA14ea8b5904396216c1603942e60bb356536ff939d
SHA25667fbf16e30906839f10829448b61309e296d887abc04a5f908e6ffa83ec4d60e
SHA5127f437be27758aee8534df082e0dc64d8199527260be6168ad2a7df7cc39b64c1b70c00f55542fd46f23c0985b1175bc45ca568153d1ffb5e8e54703cc0413b7b
-
Filesize
1KB
MD5b7e1ecb866b2eb33191c38eb20fcceeb
SHA14413206b299dc5aac01f3baacac00e97e7e951a2
SHA256f28269f7fc95d7faa389214e42c67a52c4cb56597d4afe85a082f12c51cd059e
SHA512e1b36eccb60eb168e85166db3da8435ea608dc5dfd47928da05e469d56fcfe4bac5d0e8308f98b1c0029204615d8c1e074284b7f3650a4ffd9de6d417d4eece0
-
Filesize
234KB
MD56a48fedd770d1f9fb1037f821c9885ee
SHA171c0d73e2b7038727a818a7355ce3f189680c123
SHA25620149da3c16866eabd70959df0983a0687b6b9738c86d8ea44214ddf1aa07c6b
SHA51227009309c70e81fe0249cb37705c48ab34b2a6ccc7f58b2951f40cf243e4a51549fbe745158c9e6b9c9f8b2d6e87e612e64192bfd26040ab22f2d5df625d97cb
-
Filesize
2.0MB
-
Filesize
324KB
-
Filesize
2.0MB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
2.0MB
-
Filesize
672KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
728KB
-
Filesize
728KB