Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-01-2025 21:08
General
-
Target
JaffaCakes118_62008047a46ce22d4e0b1c5d7eda6acb.exe
-
Size
211KB
-
MD5
62008047a46ce22d4e0b1c5d7eda6acb
-
SHA1
3bd9f47a4a0163ea45d3bb586f0ff1f983af7f30
-
SHA256
2739b7020e77dc33431a224e2722ad0a95fc9a77bf96e1855fc86d17f1f55ce7
-
SHA512
17844be03b8dd45d428cdb85e8888232fe5745ac7156b0f28ed421449348d30a960db4fec1353ebcc6b5c7f57f3c468a2b75edb8cc5eedfa62a9339da2257828
-
SSDEEP
3072:9GwPsm1VrwxOsf0juzv8j4P1Hr6krr4IEhx9QZe2gO9mG9UHA30Vt3E/vDjb:9G/iVkO20SFgBhxtW9mG9+Umt3Ezjb
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62008047a46ce22d4e0b1c5d7eda6acb.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62008047a46ce22d4e0b1c5d7eda6acb.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
12KB
MD5caa300673c11a7627a7b6346e1a93b61
SHA17ecaf36f1e150c478b6cfc3446ec7f0c662c071a
SHA25642ae110a0ecd0d83c4f12314d42a585354b501856dc3c7b483123fcbc317f2aa
SHA512f11f1182d2fdc14b2c64e2221091e318f76c9a41824977c1a93bf2077300bba919ca4a01c80340c4c20d239ac6dbadf091f544891f0ec72df62a6cc11231faa6
-
Filesize
41KB
MD50001408b5a533273984d6970ba2e494a
SHA1db6c6817d5990920078bec1977c8dcc287b7827d
SHA256e2c7f7142278dc3f8a2a65d5baebbd34ff89dec6316c15c1669332934438efdb
SHA51290793df85f5bf53b0fccf7e29aa52e86c99dc349d5e1c2ffd3408d33847340da4c4fe3d6b6d3c399089b8831203d3c53bda47bfb467a07280636b8995d6096c0
-
Filesize
41KB
MD5a21bc2f16f7a341c58bcc2b38f575f96
SHA15e368911e2993f4d2847aff6b8365e45ec4e8ffc
SHA25622d9bf7db8368709d1215b7361f42d66ea2d33f029c296a41bc6daa961f32431
SHA512012ae010cddcf3256840aaf8e099c723551e0d7c1ea7f1030eb8187a39297672658c6360ee53e844cf9faf9516e28bf09cecf53d273c72e54b431f33818163c9
-
Filesize
24KB
MD5f5a2754e587c08bc17284a4816da2a51
SHA1d9e095b732e3671d6c47188daf9d06a3317f26e5
SHA256de7b8fde99664c89a6ec17d77cc6d1f83add8c3f7e805aa0e0a56ee2a53a0600
SHA5128e18f65817d50ad072b3a55c9671ffa3da25aa65c044338d5803d51fcabbb6bdcd350a8499cd75acd5fd105a4eb1a9fcbc15c284da18cc96790060eb89cd2c49
-
Filesize
211KB
MD57666da9c63fca59471d51134d3dfa3d9
SHA197b88e9673bb1b4a930512aa62dd549b6a34d200
SHA256ec45e113963f31cc3d25db83984717a70d6dd07c0ce5eec6582f6b3787d9a036
SHA512a47f993c420b3eabd8436bb67dd06e9098f333007880cfb8444b1c66be4fe68fbc2268133379b8ded834c0a34dbadf84fee1aa93692927e66dca40be3762056b
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.7MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.7MB