Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-01-2025 02:24
General
-
Target
JaffaCakes118_4ac0c476330b28bff54703b4176011d0.exe
-
Size
235KB
-
MD5
4ac0c476330b28bff54703b4176011d0
-
SHA1
2123a25ae2c4fd6f92b5c6307701e102f4b1ad3a
-
SHA256
135988bdd11fc127c354e283af0fac5e908ab91a9939d01dd089da354c311a91
-
SHA512
0b3c7c101dbab5be1bcffb5f93c420f2faa69572a0a20a7f925ca822181854c0b280dc9527a47f6f1f7794fd858a4f97ea673d3b55f449e0419831aeb82e425e
-
SSDEEP
6144:UKP3AAe679MuCGA04izCqmseHPWditiXIKfftNo:UK4ZIMuf4iCBvn84K96
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Modifies WinLogon 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ac0c476330b28bff54703b4176011d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ac0c476330b28bff54703b4176011d0.exe"1⤵
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD588f672b11d4665d9e951b34a5c6fbe3f
SHA1e0c11f32f7b8c5b2901fd2accac8f57f91c7d049
SHA25672def8e10fa8e26c39164a2c6cf5ddfea6ad67bd3c0c43a2fd94930d17c1e135
SHA51269050dfcf2d7e24981ec4930ebcd56aa6df98828e6590038de147541fe54e14e2b5d8e5debb0fe5d96fa317fe1eaa193c02f98d483a4b3a56dd226dcc6d62247
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
760KB
-
Filesize
352KB
-
Filesize
400KB
-
Filesize
760KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
352KB
-
Filesize
400KB