Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-01-2025 22:26
General
-
Target
JaffaCakes118_d4d992dae0a24047dd372c4f42fe96b4.exe
-
Size
261KB
-
MD5
d4d992dae0a24047dd372c4f42fe96b4
-
SHA1
2bd1c6c6de4534472f29db228f526697594d2dde
-
SHA256
1586b1a8cec296ec48ba2a3329d51144c0bd13e2a49d8b309cad912ebd31372e
-
SHA512
05b0afb3497928e4d1364581e22e7a16702b36ea49517352df6e5ddf4c1f13a8f01c099454fddea0c054697053127f2e7afb470f743a54e86258086e26aadceb
-
SSDEEP
6144:cVBUNmwa38SsyUtYOp6TGpVZL49P8WKF90d9DqQkDij9F:cXmVVtYRKpVpgP8xz0d9DqQkDij9F
Malware Config
Extracted
simda
-
dga
cihunemyror.eu
digivehusyd.eu
vofozymufok.eu
fodakyhijyv.eu
nopegymozow.eu
gatedyhavyd.eu
marytymenok.eu
jewuqyjywyv.eu
qeqinuqypoq.eu
kemocujufys.eu
rynazuqihoj.eu
lyvejujolec.eu
tucyguqaciq.eu
xuxusujenes.eu
puzutuqeqij.eu
ciliqikytec.eu
dikoniwudim.eu
vojacikigep.eu
fogeliwokih.eu
nofyjikoxex.eu
gadufiwabim.eu
masisokemep.eu
jepororyrih.eu
qetoqolusex.eu
keraborigin.eu
ryqecolijet.eu
lymylorozig.eu
tunujolavez.eu
xubifaremin.eu
puvopalywet.eu
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d4d992dae0a24047dd372c4f42fe96b4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d4d992dae0a24047dd372c4f42fe96b4.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
-
Filesize
412KB
-
Filesize
228KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
524KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
412KB
-
Filesize
228KB