Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-12-2024 00:57
General
-
Target
f18b3c320f5a42fb861b69ff76e94874_JaffaCakes118.exe
-
Size
237KB
-
MD5
f18b3c320f5a42fb861b69ff76e94874
-
SHA1
f6a18d4a4225445fe6d6c9290f15202a94b9387c
-
SHA256
ce8f704782e78d1fc3eb9f7ee6f24bf45eb81881166be1b99cdb3bab540a89ea
-
SHA512
5f6f9c062de7fce507aec041c609b02a1112efd7f87de68d2ff067e5d6f3b392559a4306152ba60604fefd0933090ae0f736cd767a994e5cfc6cda18306eac5b
-
SSDEEP
6144:W+NuDTPypWlWNr0viNy8ZnR5oRMfpJaFNezr8:WcunapWYBZERM8KA
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f18b3c320f5a42fb861b69ff76e94874_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f18b3c320f5a42fb861b69ff76e94874_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58367f8e43f2569f226888b81ba161937
SHA129cc7e26edb47375fb1e91b99d450c0192bed77f
SHA256e0c0d778217c79807d96c36c331be7645cf34023f13e6f2294e7248f0846aa12
SHA5123d9c162c34f251cbb44f081c2d0f5654157edb3b3cd561bbd821f7ece998a99d15242cf199fbdc7d7a46025c5cac92d186ad563f4b89131fdd4b3a53d4d6790e
-
Filesize
24KB
MD5bf4d244a543063358e33e752201081fc
SHA1e5f7450ba7ad90475e45fc42ccce6d9db8e8ef64
SHA2569121d8627b17cd20384fe213b457d7e61908a126b27aac09768228a508b093a2
SHA512c339b22de875411ea53cd262f903a69c05ce9f4e835d35bef166424d0ed4413363a8bd68b6a08ff8b42485665dd9519c0b214664a849186f9a6bb9a10ea73c6b
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD5aa4e3e4b4dc1a0ddc955581a216e093b
SHA11685bfc738c62d1d7262b4365c86f2b5c5c76bcb
SHA25619ca32b0e8acfacb55c1657532bc499bfae12945af7459262beb54f90c3fb747
SHA51244dceaa3780ebaf9039d54ce2be19b40a951c57101b5226c761d937dd559d91a264f0bde337be68026c612c3bc34bd4e2678dcf9934f24c0b645428fd83db854
-
Filesize
880KB
-
Filesize
352KB
-
Filesize
400KB
-
Filesize
720KB
-
Filesize
880KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
352KB
-
Filesize
400KB