Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 08:50
General
-
Target
f83b9c515f898c2a07cca8488fb6f695_JaffaCakes118.exe
-
Size
355KB
-
MD5
f83b9c515f898c2a07cca8488fb6f695
-
SHA1
67bf85c7ac70c352318952eaffcd66e22029ad3e
-
SHA256
9050fbb21a92f1dd9512588b524ceeaffaee127972697bd230e3116f678db45b
-
SHA512
4c14572a7976b024dd659773e0521eb46fae133e74e4bf36792a9022f7a0e602c034744523a191f49b4156f971627f4311cc006a38b23d03873d4adb1187a466
-
SSDEEP
6144:q3EmWPDNND9yRPzLq+YXFqaZiMLic9kzVd7EAC4TSs9EiS:1mWhND9yJz+b1FcMLmp2ATTSsdS
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f83b9c515f898c2a07cca8488fb6f695_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f83b9c515f898c2a07cca8488fb6f695_JaffaCakes118.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
12KB
MD5e1f035b24ce0e8137682b703d19315b5
SHA118712fd6ad888c146237d187332ccc904ff1f032
SHA256117ea4f0f411e1aaeab307c087a57678abcba7e6aa96a5bd1f2d5d7026d453a0
SHA51217a428fcea9d064e8318f0ef30da88c713209f5d591d2a4e9725d56663acdb96996569693804071aea17ddc793eade219409c4548e48d1ddc8814662236bae7d
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
24KB
MD53d0912fe4d1d4711df70f4088cf81b90
SHA1f0220e259e51d9accaf2050b0e8f60d2e8640282
SHA256679675521ef473ab2d8fef229c529fe59ff13abcbeb917435e1970474334e806
SHA512179e6b71bfed41f93cb0a3e271605a792dbda75ae5ca41fa8a4cb47bae046db45fb3ff005c09b49ba04c823c9f0ea1d8403b862579b4d34ae59f3e130bfe0aca
-
Filesize
42KB
MD580652ab679bd48f76ea12dfcfde374fd
SHA13a3c4ea59534f05f0ee22a1ac563cdaee91ec67c
SHA256293e5ed3e3770db2bda56d0b133777b03b85d228a13a09ab663a6fcfac84e67e
SHA5122a1d4b98095713ae4e79e53d4791a44c870cdb206a8155030a2aad4fc2edcec99c3ce48cd1e66872df17afee195282a0b6eb7310f81fde7267d37b168be1e168
-
Filesize
42KB
MD564a6fcfca6f44ce0ff4fa865a06a6b0f
SHA1aee93fb1a343acd94846d2172632dc0d2192d066
SHA256afd018e6a11aaca64dd0756d70cb5c159dd6b257a0c7c095c4ee4baca42f6f02
SHA5124b2ca4740391f4ff19635f4454d9e5429d4abffd68e2ced9116447806d4682fb98e0973c951ad04b1715e089683eb932613b30ce5cf3ba454cbe6462882c98cc
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
61KB
MD54b53740d4fbf814ec499714f6f6b24ae
SHA1862171e7b8137372e680bde2df832130bed37bf9
SHA2564bc1336828150ecb26631a552e82a9b2b0b179bfa666707470c9e96135543d87
SHA5123951fbc4cf33e799b27484094e98bb4c9973185f4f8ff7f4da8c21d5656490e920d95005ca518023d930f3e8109f0075a5bb791153982933866b9c4b87a5756b
-
Filesize
24KB
MD5250b0b07e72b743aca98f6ef017ee20a
SHA1284c188a09bda414d0b5b8f981ae6c1a98064b60
SHA25657b311a1f9e363f91c91cf94e04541579fccdd68d3ce68d28704bca99c206c09
SHA51230ee95ea2b90e4cc6d8e2c2eb33a42dcf8e49e1ccc4fa9e4bf8a70eb02016ab3e1e4f3b85b5e1db673e404d96a6f745f7a1825349ce94e21a2b33ead2be4f2ff
-
Filesize
355KB
MD5521f9a114568817f2d8280f082da0048
SHA1cf6a0b1422feb8a2c56926ba3343cc418f07b44e
SHA256e9a38a36ccd715832831c517721021fdc8436b3c0f4c261e778cec3c5e7020d7
SHA5128536a4c4be990684f0d0eaa56c8e958b3e6204ef1116168d4823032558be663afafb86eb310313938d0259729c56e46da6195ec74583e2b98c119796ee617be6
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
380KB