Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-12-2024 03:51
General
-
Target
cae42ec80a74d5dfe5aa09beb3805821_JaffaCakes118.exe
-
Size
204KB
-
MD5
cae42ec80a74d5dfe5aa09beb3805821
-
SHA1
7710f3ab01d5f1c6bde7d813f00d79f7f3446cea
-
SHA256
8a95169f84a5d5fe649aa62fdc7d8afd2946f4998bdb1d90997452f9fda9f19d
-
SHA512
3fc3eed23dd9136d5a454ada7951a60e19252cb6d8159a737efd6f9fbe2f135a89210c4a37c4dfc70826940ee937f163df16f130231771c54fa10439aacf67fe
-
SSDEEP
3072:qOJM8BUIyMh/fuGk4SGkjyu3wMD32onjlWnrBJke78ilZHMOke7QezadcarPCYpx:8IU9MheRXngMDmgV2Mk0JcRYenA
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cae42ec80a74d5dfe5aa09beb3805821_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cae42ec80a74d5dfe5aa09beb3805821_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD51dcce2c1faa4fd39da978ee06d7da09a
SHA13a67eeae04e6ff26a26d79c262b573455b3300dd
SHA256f51495b7fd2a8be35524606b9ac57a3e7e34cade2fa854731ca430eba3dcf96a
SHA512629cd5fbb04b28500628e2d0feed128d0adf07ee997fa444359da26bcbc07f17e0bb552d32b88d6c31040bf8e3228c09e30d2f51002bb00e76164aebe9c8e308
-
Filesize
1KB
MD554e029d7bd556d2314a8dbad3d543608
SHA1279538e064a62d905b4afa968e866226519057ef
SHA256477904c3354bfdc4f56396ccf2b830d6306eec9c61d826bbf507536784ee47f7
SHA512b66cb1908e44994ecf4c3f4b1db2db63462b15f50d50124ab642e11f6642e1fc9b2115dab2b590252682519804aef1d5dcbe1749e1150fc05d42bb46a105e651
-
Filesize
204KB
MD55514079c3cecd5ba8987b157e3a3ef08
SHA1a1d9ea196469f7ca0a042a9fa521047f0d389a3d
SHA256b789a7742a554ac0b3837d942800de01d80f6f53996f8f6aed90ec252c98e182
SHA5129cd618bafe5bc77bcd97c72e0e17db955dc5299ebecedda8d8cd1a746f9dc11bbe7b7a5173f94827bf2557ac14c21dd106477dde395e56a2b8ada6fced6f3886
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB