Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
25-01-2025 20:44
General
-
Target
JaffaCakes118_2f78d563ff3c9f6399e4c5a90d784d49.exe
-
Size
196KB
-
MD5
2f78d563ff3c9f6399e4c5a90d784d49
-
SHA1
a1d05d301ae2fa9da277735fd550890df37d3e72
-
SHA256
710893e68c314120c6563e5fe70ce9a154ed838a595fe0e1a7d0a74ba34e9f80
-
SHA512
bf84fc9b90875d7bd3046f6b7eea2ef9970086da1ffd1f6d044c8e2789f947ff6081e5c2ecdd495b654a267914133f4c3c368f8a2e36acccb924c48dc7c88261
-
SSDEEP
3072:x/mZYtsHNineBiARdmtTaEatj7J/gUJ/Pgrw/IxPymw21+FPLZHpZoHOyew21:xC7oehgI7tjOUJ/Pow/IxWRfHp+H
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Program Files directory 28 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f78d563ff3c9f6399e4c5a90d784d49.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f78d563ff3c9f6399e4c5a90d784d49.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD593934cf6491952bbe3869bf27c031822
SHA11ec9d7334e12e37e1141e90d7a394c9596c61bc9
SHA2560de910cb8e33e7a6f9c4984d20ed5af7dd555fc4ae57f6a29abd86e50f98a86a
SHA51281ed20960e3a223fd7feab18cc22f7f7d350f70b92289a4672f40c58d9f486df3fda0576e94e8f28978b24ce3ebf7aa86438598db20c78a569c03ed1c2adaa09
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
42KB
MD5478bbc9236aabc487fa35e2d78761346
SHA1c7f66e3d70102f69dff436ce18bb6779bfc3b502
SHA256c7d682a95a230c14bb011521263fd7838553d0146a8addea558894c87221e429
SHA512b17c4f455ab08aece281cc6da99c16d60c7829ac15889cff59553bd49d669151065c1b80ef831bfe101049ca7c799e6c201293c5adff15fb02f571f2b02c9e32
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
196KB
MD52f051fb2348f9dcf1f2515ffef27d6af
SHA1baf40d2125444dfd517b562090f2deba53711835
SHA256202b24b03641588b3bcbf6d0f88344c27dd8b7e5e684d76d4ac9afd687777f2f
SHA512a6fbec9fd8b3c7f03c9650d7c1a804e61d1ea25d7971bc4c8142e43b72037b92ad176cb566ee743bc7811b1f0af0fffde78a447f4a11e35393de8ed2ea9d2cd1
-
Filesize
580KB
-
Filesize
316KB
-
Filesize
368KB
-
Filesize
580KB
-
Filesize
368KB
-
Filesize
316KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
580KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
656KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
580KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB