Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
29-11-2024 16:31
General
-
Target
b27d91895cc0907c9d00653c256ad91c_JaffaCakes118.exe
-
Size
217KB
-
MD5
b27d91895cc0907c9d00653c256ad91c
-
SHA1
5cfbd2106d58a05dfdfcc69c2e0cdd46cc87a566
-
SHA256
b5656bc5b4180052d76117389c1e2575af8e4de974da32a330803111a6541ff2
-
SHA512
dcb84756b7a008a53c3a65bc2fd1447e382f9b7cef4285d01df2cfd1ecd0bdb701bb3e96ce647c880872bc2f3fbca6536896a5e682e672791433231b4d51546b
-
SSDEEP
6144:hrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:JsTbzu1glovW4EH6Y
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b27d91895cc0907c9d00653c256ad91c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b27d91895cc0907c9d00653c256ad91c_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD57a30a2c3eb3723450491b9f6923a0e49
SHA1c8a8ebca9c5dc82db73cac6a32c0b15b5b455efd
SHA2567787a52106a6083d023ef31c268ce2e934c5e61032c6d0e52bf16f452a553b47
SHA512b89a067b0aa8aff915cbbb0e09ef18e72143b3d112e890bacfea7e7d09d832a5f4270fb15456fdce0ceffbb6f6488eb8a24e2ce004e6e0252442a49509f7df6c
-
Filesize
481B
MD5c9d8abbc185f202116986c6fc2849504
SHA19dc944a2b67a9b99f237ad268354c2cc651d50ff
SHA256801e855038bebe36d59cb25a84967a315eb44cd8e8b89e96ab8e0f49b12fd43f
SHA512f53c0c69f7cd2f7a2a432034043771f5b3b19f30b2be7759ffae2dfdb25f49bac796c8df8e152e11db23503d0cda677bcaf9c20395182e195a2301ff76d5ba51
-
Filesize
217KB
MD5da7c15e176fa7aa324a3f7f0c5bf1d2c
SHA120d04e933ef90867495191c8437fcd5a61972bc6
SHA2568d53b9d811e8524371f22dff5c96cb48f21142b19b9adf8fc076517b4bb2cc9d
SHA512c154805a1d1652cfe81dd35cc6a8d6424ca0a09a873aa1af21dcdd916562d2f6f18bbd08fcf03d1e8d511679cd43b55b95531a024c5ade1b5a338209c4f9afb7
-
Filesize
1.5MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.5MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.5MB
-
Filesize
1.5MB