Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-01-2025 13:45
General
-
Target
JaffaCakes118_0e33b04b1ccc7eb3891363b18af1907d.exe
-
Size
210KB
-
MD5
0e33b04b1ccc7eb3891363b18af1907d
-
SHA1
4e6a8ddd87bb7ba6e9aa77c268d9e277d917cca9
-
SHA256
1224f386d990ed1d2406087114c2420951fb7b2095199a2f0c559e8a14b2af01
-
SHA512
18fd5bcc7ea5b031f8452be7712b24de823e6fa93d0db12b4f79714887f6327f9468fbcf94d1ba1a736e951b83dbe385a9c9956380093511f1a98b3a5f2c0a6a
-
SSDEEP
3072:Ht+o2adNnckCfKpqLUJFmjoKzLCeGB1lNIX3fWjKAkNCZs9I8ByLJOdEtuEuNrBk:n2KpBuZef1onf2KAg/9I8Id9MEuq+b
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e33b04b1ccc7eb3891363b18af1907d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e33b04b1ccc7eb3891363b18af1907d.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481B
MD5589f1e55628fd9a50a0c57bdc05ea3c9
SHA155e725c60ff4f12cb84db062633770831c63bb76
SHA256fc6a6cc4e36235826044c03aebea46ec8ae532622511f0156d7c33252031f8f8
SHA5121826573eace2f52187c432cf42f02b7d1a66bc1b761764095b993bf47bc40944ac72a11a495bdd5865e63f7d840770bb6c5c9d05855bc7bdae781b9a445a8699
-
Filesize
210KB
MD5c913f7c68baeb68f9ed806dea2f910c6
SHA1d8e34a3e593f93ad2dac7eb6e2095dab9e2954d5
SHA2566ae9dea503c37f7b995f06e852893a20065211593ba8bff40215228a290fcf8f
SHA512b4e18b4cdeb758b58b77ae967dc1c2c17393402332cbcd12c9ce4bbbc1f93dcb0c6de0a1f8de23ff2cb9b0c02a04474005c0e9f25126ae6af149a6083759ba2a
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.3MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB