Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 13:45
General
-
Target
JaffaCakes118_0e33b04b1ccc7eb3891363b18af1907d.exe
-
Size
210KB
-
MD5
0e33b04b1ccc7eb3891363b18af1907d
-
SHA1
4e6a8ddd87bb7ba6e9aa77c268d9e277d917cca9
-
SHA256
1224f386d990ed1d2406087114c2420951fb7b2095199a2f0c559e8a14b2af01
-
SHA512
18fd5bcc7ea5b031f8452be7712b24de823e6fa93d0db12b4f79714887f6327f9468fbcf94d1ba1a736e951b83dbe385a9c9956380093511f1a98b3a5f2c0a6a
-
SSDEEP
3072:Ht+o2adNnckCfKpqLUJFmjoKzLCeGB1lNIX3fWjKAkNCZs9I8ByLJOdEtuEuNrBk:n2KpBuZef1onf2KAg/9I8Id9MEuq+b
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e33b04b1ccc7eb3891363b18af1907d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0e33b04b1ccc7eb3891363b18af1907d.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
24KB
MD59fd5a4da549c91e43a616daa3b55a91b
SHA17f24083d1196507317da4ebaa77a9772a997a320
SHA2565d8585bcdd0760282ac68fd14694e587cee6acaecf2af9b60b4eb16c85f5690d
SHA5122f7c8feac3f50f63b6a7dc0e0f9e18426431eea07a7241a0b3ab070a0cec16f604c7bac609c2d5c1a8d411a18d66d2b8f71e473a4fc20f74b8284fd70317d102
-
Filesize
61KB
MD58300ade30a7ef416d0a1ea8c7a775ec2
SHA1b0042fa917597191ab80b224de7d31227faf13f1
SHA2564d3fd085438543b1f71e9982f354635ffe51030d1130fc066ed076c9a121908d
SHA512cd9848a47ec48da13ee8079ba7548191a5b79a42a130f80bcdda9888b6dc20ca96aacab72ad2216eea50c43afa5373bdefd5a763ed6b162df5527ff69f2df8c4
-
Filesize
42KB
MD5f916e427e9c40fe57029809f10275085
SHA196de0bd915e55a8e3ff2a31ab7b2e6d4eccfeb60
SHA256466d6984c83a83bf5f07cf89293ccb3a6c5342a90f80aa803ec12f77fa5eb976
SHA512fb9ab63709b642ad12c38248f06c6a68dea8b81750893c878d2c0d7719d9f07de381ac306d861adf436c69f3e79899aaa5f82d142f5c7b8893b953471145a5c3
-
Filesize
42KB
MD5c54923db1c1bc552d52c52245159625f
SHA13ed117c7bd4ed5d91933755325b445a5da91f949
SHA2568bdaabdc6f23703a63057f02add45142449dd545b53e5dcb8b6ec0cff29b4c3f
SHA512e809da00df875de6bbb99cce8bd37b5bfe2a9000d64c35cd82cf44f9197e2e40e835bb597931c4fe7ef8d09f447c282382e2b81793934bdd189d1089cff54a3f
-
Filesize
210KB
MD5f6369a054066c31a85f5ba2011ece390
SHA1e19c54b737f0844804dcdfd1753139a406614070
SHA256a86a0005dfa031935c3b35a07188cc91576b7a58cda6485f9dee8f868ee50973
SHA5124d04f85ae8b3a647769f9e69f6115702e316a62ff3ec77e1c4b49c117337d5fd7a60aa2abe0309fe81d41d6d50149af9a9de0a75436a9b1bbad21eba36cce48a
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.3MB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
672KB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.3MB