Analysis
-
max time kernel
148s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-12-2024 07:42
General
-
Target
cbd281a06ca794a079612da4106e6f45_JaffaCakes118.exe
-
Size
355KB
-
MD5
cbd281a06ca794a079612da4106e6f45
-
SHA1
250d7989a2f90e28db11a7a9134080382dc6e4de
-
SHA256
21fa9fafc6db3e0d886623997eeb841e1ea0d5903e892b60977f488fda572669
-
SHA512
e8eee51b2dbd178b7f82f2dd802881383b2028273615d475a107a9c3153d8d192c58a6b05b146fcca24ce7ccfef2a637ec97b16afebf6718aef6c02f175ceb38
-
SSDEEP
6144:J3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:emWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbd281a06ca794a079612da4106e6f45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cbd281a06ca794a079612da4106e6f45_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD54926ec9db316243c3ba2549b5a7a9386
SHA181359a7e729672e1366e953e36daf5eff0c2f8d9
SHA2561cbd9413af2bb51313cce2d23a5aab90f294f13ebd35b9be2c4fa61f52e45390
SHA512223844f8bdfd6870680fe11ebd6986776c8b159d1683110f64f614c49788df01397cd4d34d4ee135e5ed54290c08973aaaad656afbda7d0c39b7d7077aba0edd
-
Filesize
42KB
MD5071903906c89e430e5716ebbb99cf16b
SHA1decb86879c1eafb5753dad40e4621f02e796b78c
SHA2569199d422ef3ecd4ce5ccd6d71e762f1fc21d68c7361f3595259204f3fc99c8f2
SHA5125568ab2d51572035fdb9e3b207a6e76df11b0e50acc69b9b314fa99b203ffbfd1d0cdb4ec5b7c4909c22e9575367229996a8935ba9119b80425774534a94c89e
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
355KB
MD5beae7e24061b30dc2b20dc02fd116e58
SHA19ba0629473b3b1aa163cf75cc86abe0003f506b3
SHA25643e2c48a8a0e974ea317a5878a3a17498f34558e046807ffa6771c3d6000dc38
SHA512acb43cc51af2a0e76192c782cc7ec3ac020d678626337a89c0733d7f2a972389c0134f0057f72adf01c0ab9c017997a0f243ebcc751bdb1544611c6f60cacfd2
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB