Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
03-12-2024 00:18
General
-
Target
bada314291a0806130d3b68df4bc98ed_JaffaCakes118.exe
-
Size
355KB
-
MD5
bada314291a0806130d3b68df4bc98ed
-
SHA1
a740156418a6c2e7a1469c38cf57d70f585b6661
-
SHA256
746caaec340337270168cbc2c4cc84b9fd14a7f20be0d4657004cd935df867eb
-
SHA512
8f769e1a7cba3934377d97b8b24ab036de80bd719b3740dc081990b246c386915e783cdd714b61a585d8ff3740deb6997757ebfa5160ab8b1f4caf72f377488a
-
SSDEEP
6144:d3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:ymWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bada314291a0806130d3b68df4bc98ed_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bada314291a0806130d3b68df4bc98ed_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
593B
MD53b03d93d3487806337b5c6443ce7a62d
SHA193a7a790bb6348606cbdaf5daeaaf4ea8cf731d0
SHA2567392749832c70fcfc2d440d7afc2f880000dd564930d95d634eb1199fa15de30
SHA512770977beaeedafc5c98d0c32edc8c6c850f05e9f363bc9997fa73991646b02e5d40ceed0017b06caeab0db86423844bc4b0a9f0df2d8239230e423a7bfbd4a88
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
481B
MD5a9ab936a49d9d8d3ec3d9e79be317838
SHA1831c48ca496a4e73958c7fd68f59dc70481b9aa0
SHA256934fa1b911ff5e05e16af07e8db4dec0be6b834a4a2ae4cf0743dad691abc45b
SHA512da36410da962dcbeaeb188ad154bb82706a295cb8e9290b4b4c6e653fc6e7bcebad2a5f31e3486dcb6137c0609b6647228553b7e38ba5eea38728a37fc4c9b85
-
Filesize
42KB
MD54dcd18a80080ca728694e67b30d7e78b
SHA1cf66ee8aa7af1ee095b20745f9bd1b32e8f8bc38
SHA2567de8e9d88885650d2ac9e282410475174c00d3d23abf7009cd3c1ca456fb2a0e
SHA51216525ef0f842eafe7d78ece46af7a086ef3a432fa584cdf1482ad474cfe9a65d081b28fbeba892ac3d44d531b0e24a7640304d4d95371a39d4b10432b808a748
-
Filesize
1KB
MD5603bec0ee7da8385c31f1dd6c394ebde
SHA1b3e8b30ee453a7adfa25b0425751983edda6f1e1
SHA256723bc5c2c94ff704fd1410581577f3ab60a384bbc21cd71aeba64c8c3d54efe4
SHA512c43e82e99a4be95e3ed45bcd8a22bd986870064afeca7e8b91ed5a86320eda9bf61d7331215e9e95fb0d3fc795bdb19c0f2fd09b12ed5b0e568da6e97d51e61d
-
Filesize
1KB
MD5138e938ecc10ff8fa0f924f6e06cc619
SHA1a1ce8baf6ecdc2fcaf0f9a8b63ffce9c0f472e19
SHA2565e62630de7d7a721bf6b2244458cbd1bf74e3665a7f063433d51e85f6c9b3125
SHA512960579a3d6ee2d43ef70816c45cdba9d1734819b5fc21949f2edfc9d0bc3515c58b78de7366f479871ce6fac43d58a8f7ebb30fa69959aa494a4c1c0c7dc2ec7
-
Filesize
481B
MD5cc7e9496ed971d5893a5104c821bffe2
SHA1a8e1fc9d307e69dde7bf060da7cc967c8b095034
SHA256350e34cb82814a8f2102109d32f57220050d4b19f66f2c0e74c2af9809b16c5b
SHA5121405b468063ac663ea92293e3e253552df685937a047711a50ee5da7d1a0fad723ac68ee1953f09bf6415238d328fd4dd41558e4b8588307f83673bade91e991
-
Filesize
1KB
MD56655b647c1ad3fd3e9bc494943beaf41
SHA1b93c547758e7bf638a3bfa71b8db647125687d9f
SHA25625031e5e0c8b01e934713749d0904643fc3475d020340293bc636b905274a715
SHA51264f2a9255ff0a85ddfb91b0b152f3edde0269b1d9cf31fcb5fd697c777075e44b5f0517cc41d521decbe0fbd9d435b7e1d677f5e5eb0500b39c65e8fe4b44615
-
Filesize
355KB
MD5870b1bf784f96a328f5712f6a9c3714d
SHA1a881f1f352f8c1b39162ad0d980d7e85b2f3d379
SHA256b377a2c6e02bb2e7ee69647cf04647b790505a01cbce858a4906a3cd123d3a50
SHA512a8c0b8039bb597cf835f1469ad3064ad40d8224c519b8e6ab9f802cdd6d1f7ab76e3dc9221f408cca2ab2dd1a6bcbe079cbd952698bea6c7a70ba084d8f0e711
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB