Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-12-2024 07:42
General
-
Target
cbd281a06ca794a079612da4106e6f45_JaffaCakes118.exe
-
Size
355KB
-
MD5
cbd281a06ca794a079612da4106e6f45
-
SHA1
250d7989a2f90e28db11a7a9134080382dc6e4de
-
SHA256
21fa9fafc6db3e0d886623997eeb841e1ea0d5903e892b60977f488fda572669
-
SHA512
e8eee51b2dbd178b7f82f2dd802881383b2028273615d475a107a9c3153d8d192c58a6b05b146fcca24ce7ccfef2a637ec97b16afebf6718aef6c02f175ceb38
-
SSDEEP
6144:J3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:emWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbd281a06ca794a079612da4106e6f45_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cbd281a06ca794a079612da4106e6f45_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD57df79228658dd9ed504d412afefd79f2
SHA1a944fc9518b5239ecc13069bab14a3939d4bb7f8
SHA25645e4a51591f219e82557f647304b6d9f6248f75aa794b71344cee7901905b0db
SHA512e41a91482845444fecdaab055368dd494a1d005660148b0fc0db738dfd117d3daf2b8b564d3095ed99da3cde08de2a3d87261dcf0eba3a4061d1f54b261baa5c
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
42KB
MD5220ac4d507083375cd79a5502eb90985
SHA159cbf0337722110f3e05db309de06c727d918b46
SHA256600f4dee9c2674c0f77a74be011c6499bc6e571cb8d9d597c358ba648f1f1184
SHA5125ecbf765c3fca46e7432ec4a0cbbbe805a1a6cd2c8c95ed4c84f09f51b67e0b8f9f6122d21a0c2022f748cd20e6527a16abfef5acee9776dda87558787698e5f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD5d0e1bafdebea5fb53b2dfd5968be9393
SHA1f4ad796c190eb04386b775efd75320969fb4639a
SHA2569483b59e1bee893d738d97e07a3f8cb986be58e78a983ac98b52a24af5d8c665
SHA5129f23063fa133e712e61f824fa5965c04254bf56d6cfeb930a2f901a05307699838f72e5c1aaf15d9b60377e2b201e8bae4b7dc09e144b93b1f9f03c6bd80ca81
-
Filesize
61KB
MD58becdd67f468e358b38eb52eb0c68e0a
SHA1e667084faf3f80444f352fa1e8679ee710554c89
SHA2568065ec1b66f04439bc4b07a9aac759eef0488a0ea268d14ff35b018361ba6958
SHA51259a8df9e4e3c9b08a083dda58fd5253d74185e1c0ca6ebd9b628c128e1b1a46f9769ecaac7348b1dba6ba0e781325887c0b10d0a9f62708cdb95b04d5831a46e
-
Filesize
355KB
MD59323e5e45be497daeec864f8447d1535
SHA1756efaa7de3d0263385d92b5586774d92d282320
SHA256278cc8d7ef9946892c6e3c217187b8a72007b249267cf25c4edcfe9a0979ca15
SHA5125f27950d129eb107eb88f99e821cb386919f5886a14e70279d5931d55de2df6f6f69c429bed5f0dece59d441c3365ef71397dd515c95bcd2250b43688329e2c4
-
Filesize
380KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB