Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
14-12-2024 12:52
General
-
Target
eed944d3d991fa8bd6017bbdcd1e5e74_JaffaCakes118.exe
-
Size
244KB
-
MD5
eed944d3d991fa8bd6017bbdcd1e5e74
-
SHA1
27ff0363488fde8805213eb13fbaf3cfaff0f4fb
-
SHA256
8163c58957f792740469c99e097db09fb33e962ad9ad8e4a0dade3d1e04d72e2
-
SHA512
c97e54d241cef5612c64aac63a037155fd557301ea7f981811366efe63f5c39b7bf9c68a5c28c05bbb9c104836e269fca06ec1498c3edda269ed02963d5d0435
-
SSDEEP
6144:qZrtXGIihxI2WZLKp79aO1XcbMjt2oaIJ8cWZhzCbFHTK9F:qiIUx+MH1XcAQIHuIo9F
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eed944d3d991fa8bd6017bbdcd1e5e74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eed944d3d991fa8bd6017bbdcd1e5e74_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5590779fda92aabe35a9e5c476945445d
SHA1cc919f92cee696fae3f2a18c0d605ce92ec717f1
SHA25611860b4eb691c3da4f810bb6c72d96bff7ef2edc66a2e39ad0504dfdbb4b805e
SHA51290a175d0fae7f2fa81f816287cfff4752c7018a4b8f4fb4475376ceceb3db244e989a600af5d335f92cd154345039b589184ff56ace39be1116251efd6df9572
-
Filesize
24KB
MD5a70e86ebdcb45e09d7ac59ac8fdd2f16
SHA1c148d20d496008dcca192218e3c159e966fa2a01
SHA256084d173a18c92e306fd60a936d4683d210d6c515880dfbdd6923cb455676e4f1
SHA512fd0cc4c70b989c82a06c9d213be7853fde9a17c3422546f5254d3cd65a41c5b42dc97599b5a0bbedb1ca29a6e06d21a75667b829a7f76c9c3f23a9288415e3f7
-
Filesize
1KB
MD587542a87d7df58ccfd646cc9de972bec
SHA1f6b5a052a7560eb01706d713709841cf1a72dff4
SHA256bf03e0d32f2a377dc04d1ed3872ec66f516af58913157470e19ca3e040cc3470
SHA512ecc6974d649469987f2a3af25ba934ef923781d14f7cb956fcdfd5b647e4d44afea9dee799f2b7ba76e2c1ebdddc17a681b89a08b1fb8ead2504cf4002a52fca
-
Filesize
352KB
-
Filesize
400KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
2.0MB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
352KB
-
Filesize
400KB