Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/12/2024, 13:18

General

  • Target

    ebafe06464c9041495c988c3dee0481a_JaffaCakes118.exe

  • Size

    275KB

  • MD5

    ebafe06464c9041495c988c3dee0481a

  • SHA1

    5abf2cee96ea2049a6c47573e437b6f6486fdc1f

  • SHA256

    722a53ac4e7b5c4790e4cffb9f0cba7d59f0ff4fcb20692678b9e765a5deef96

  • SHA512

    36db3ca906141069a76aeaa1878c0aa14a2643af7dabeb84da34fa1e415b4c20b8f1e2fa7d9629191379e86ff61d39f831b86d8765a76ac7862c4c57e9725f8f

  • SSDEEP

    6144:kN/HLlhG/8jNQMyTfyZ1wafKa7Rs7PuJK6:kNpdNBEeK43

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebafe06464c9041495c988c3dee0481a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ebafe06464c9041495c988c3dee0481a_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:1288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1288-0-0x0000000000400000-0x0000000000498000-memory.dmp

    Filesize

    608KB

  • memory/1288-1-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/1288-2-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/1288-3-0x0000000000440000-0x0000000000441000-memory.dmp

    Filesize

    4KB

  • memory/1288-5-0x0000000002300000-0x00000000023B2000-memory.dmp

    Filesize

    712KB

  • memory/1288-8-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-11-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-9-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-65-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-113-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-112-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-111-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-110-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-109-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-108-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-107-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-105-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-103-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-102-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-101-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-100-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-99-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-98-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-97-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-96-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-95-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-93-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-92-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-91-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-90-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-89-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-88-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-87-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-86-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-85-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-83-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-82-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-80-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-79-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-77-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-76-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-74-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-73-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-72-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-71-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-70-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-69-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-68-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-66-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-64-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-106-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-63-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-104-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-94-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-62-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-84-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-61-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-81-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-78-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-75-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-60-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-67-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-59-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB

  • memory/1288-140-0x000000007FDE0000-0x000000007FE49000-memory.dmp

    Filesize

    420KB

  • memory/1288-142-0x0000000000400000-0x0000000000439000-memory.dmp

    Filesize

    228KB

  • memory/1288-144-0x00000000023C0000-0x0000000002478000-memory.dmp

    Filesize

    736KB