General

  • Target

    JaffaCakes118_dc03c5e99a1040f3e9767c6738d35370

  • Size

    263KB

  • Sample

    250210-q2vcjatqcv

  • MD5

    dc03c5e99a1040f3e9767c6738d35370

  • SHA1

    d2d2ac085aefe0b176d43efaa9032893a39c56bc

  • SHA256

    943a366b83b477809d0f50484d7e2db5c7623f2cf82326f83fe3ce5cde41734a

  • SHA512

    a9db17b9d5565c4b2c81a7a4bab410ea4e243aacdfa842212e3730a7f0e90cd041741485c75ab1f856cf82eff622ab4720f627c940f47345fb9431ba4637ead5

  • SSDEEP

    6144:PhPZy+chYf9vFAQewiHStKoOZ3j7BAkQd/b+TGCokrArDP6c:/Bf9FLlpOJxQdjlD7

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_dc03c5e99a1040f3e9767c6738d35370

    • Size

      263KB

    • MD5

      dc03c5e99a1040f3e9767c6738d35370

    • SHA1

      d2d2ac085aefe0b176d43efaa9032893a39c56bc

    • SHA256

      943a366b83b477809d0f50484d7e2db5c7623f2cf82326f83fe3ce5cde41734a

    • SHA512

      a9db17b9d5565c4b2c81a7a4bab410ea4e243aacdfa842212e3730a7f0e90cd041741485c75ab1f856cf82eff622ab4720f627c940f47345fb9431ba4637ead5

    • SSDEEP

      6144:PhPZy+chYf9vFAQewiHStKoOZ3j7BAkQd/b+TGCokrArDP6c:/Bf9FLlpOJxQdjlD7

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks