Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-02-2025 14:35
General
-
Target
JaffaCakes118_e755bd05c333b8773444f81cab0925f0.exe
-
Size
227KB
-
MD5
e755bd05c333b8773444f81cab0925f0
-
SHA1
0ba8fc9877b55a340963ebd69d9a05b5e6178a04
-
SHA256
b2d811aca4583900557c6467212d0dc35680ed1707530ce41bb616f08adabe99
-
SHA512
2f083dae13a74ef331734260f48cd08ccec203f5653fcdd50ba9c9ec58588bc170518c25e3bcfd1b9395ffa06e296f47f78a5fce0dde55433f2f1b7319725518
-
SSDEEP
6144:4rx9HGCenzAjjHlEJyWYg1vvIAJVRqR70v6860Y:47HgIuYg1rvRF6X
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e755bd05c333b8773444f81cab0925f0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e755bd05c333b8773444f81cab0925f0.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD58e3ee3234a43b6d3c6eb9b8b6156459c
SHA1b4479ff3bfa756e551b1f01be7433f0b112669f1
SHA2569dbcb02624e0d7534aae691feca5f427c55835ae3b87812073762ad08244221b
SHA512010950e27cc1b92e923fc1ad234a0e35357c0d4dab8ba5e2be7f460b49be08d95d52b18c8b430cd9ef1f203312983cdbdaaf2e2c5c9e44d3db369a9f1be13452
-
Filesize
1.8MB
-
Filesize
324KB
-
Filesize
380KB
-
Filesize
1.8MB
-
Filesize
380KB
-
Filesize
324KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
1.8MB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB