Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
-
submitted
11-02-2025 16:49
General
-
Target
JaffaCakes118_e85b3594ce638ff4a027cc7baecf1bfa.exe
-
Size
259KB
-
MD5
e85b3594ce638ff4a027cc7baecf1bfa
-
SHA1
cb8ff1b8722a819aed670d2a4edb97ea03a97c65
-
SHA256
a36d6ebaf2797f68e6e8bbde6b4acc7ba6d8780ed4519057ffafcf149b4f4bcb
-
SHA512
c2ca5f8fb9862fa1ab3b86d63a03f3ceff9d9b10c6d44eb6b8bc7bc2d0d08e2a9d16632498979c87f5e4d5561e17d8fcbded6ef141e252ec14b936604e03839f
-
SSDEEP
6144:iyK4+vW9EnkxPWu9oYUkZYeLoerbZP4sdA9hmEPpW5rpH:FK99kPWqBU0LDrNgsdA9hFPW9
Malware Config
Extracted
simda
-
dga
cihunemyror.eu
digivehusyd.eu
vofozymufok.eu
fodakyhijyv.eu
nopegymozow.eu
gatedyhavyd.eu
marytymenok.eu
jewuqyjywyv.eu
qeqinuqypoq.eu
kemocujufys.eu
rynazuqihoj.eu
lyvejujolec.eu
tucyguqaciq.eu
xuxusujenes.eu
puzutuqeqij.eu
ciliqikytec.eu
dikoniwudim.eu
vojacikigep.eu
fogeliwokih.eu
nofyjikoxex.eu
gadufiwabim.eu
masisokemep.eu
jepororyrih.eu
qetoqolusex.eu
keraborigin.eu
ryqecolijet.eu
lymylorozig.eu
tunujolavez.eu
xubifaremin.eu
puvopalywet.eu
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file 1 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies Internet Explorer settings 1 TTPs 26 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
System policy modification 1 TTPs 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e85b3594ce638ff4a027cc7baecf1bfa.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e85b3594ce638ff4a027cc7baecf1bfa.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RUUyRjZCRTktMzZCMy00QzlFLUE1QTUtQTA4MzI4MTBGMEZGfSIgdXNlcmlkPSJ7NzAzQTJFRDQtNzgyNS00NDZFLTk0RTAtMkVCQjg1NTcwMTI5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7OUMwNDUzQTUtMDQ2MS00OTlFLUFDQjktRjVDNTEzNDc2QkVGfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjEzNTAxNjExIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\MicrosoftEdge_X64_132.0.2957.140.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6037ea818,0x7ff6037ea824,0x7ff6037ea8303⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{EECCB076-10E1-4F6F-AC85-79AE84AEE3B1}\EDGEMITMP_A9977.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6037ea818,0x7ff6037ea824,0x7ff6037ea8304⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff79bc6a818,0x7ff79bc6a824,0x7ff79bc6a8304⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff79bc6a818,0x7ff79bc6a824,0x7ff79bc6a8304⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff79bc6a818,0x7ff79bc6a824,0x7ff79bc6a8304⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch1⤵
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5b4c8ad75087b8634d4f04dc6f92da9aa
SHA17efaa2472521c79d58c4ef18a258cc573704fb5d
SHA256522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf
SHA5125094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3
-
Filesize
3.7MB
MD53646786aea064c0845f5bb1b8e976985
SHA1a31ba2d2192898d4c0a01511395bdf87b0e53873
SHA256a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f
SHA512145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4
-
Filesize
70KB
MD57f21c78925c91bf717f0f05930de7385
SHA1dff1353dff160633d1c87fcd4c81f39b26e52492
SHA256ded40dfda5d7f99f55b9f02a1049e538251698b34fef19a38161f31715ee647c
SHA512fe4fc673cd5dcaea4a5fc973c5279836b855ae8eab232a01fc5f966db60daeb99e82c2051158147914fc04a7cc74a0dd2fcb8919c7ca3dd7864a7c74636a2e8a
-
Filesize
96KB
MD5bb5a95e3b220d44fa2692d662d1a2f10
SHA13cbf4599f9e05670e2823abfbc6c03c6238b9c64
SHA256611118822e0e8090809165f97e2429c2d5b023a8dfcbb878ea10cba3ad3a13b9
SHA5129e711fcf4ec3c1b17e214aff7c6e92648689bec38b7cb6aa37ec74fc228ac362b0a56e73770ec5815149b71edf1608bb464bc350aaaf08b7ce2eada864ac1959
-
Filesize
101KB
MD5e983624e4b87a8979cabc4a87bf38da6
SHA1eecc6600cbcd4d081d499d89eda4f69a8d4eec84
SHA2561d946e7ef35cfc67f1f07f411ca80f39c01e17b2dbc8d5c6f922a9685e6938e2
SHA512db254da96b5f414895ad40d203d63a542eecc01c0e1bdeb68b354e80802a6579eae05e5deb160314a5dbb2ea518f92d9cdad751bc971006c30d6531a1753308f
-
Filesize
102KB
MD507576d0500ac9b6eec02b7fbda25c2e0
SHA1532da26dae0c4ec1d09f597b28c7fedf9df99ac6
SHA2560cb7001f97da50d608407abbc2966626cb5e15604e84437c6b55c9940cf5f5cc
SHA512dd4ad554b5e6982ca208ecf906568f0289e1e6a86dcff9f1b76ebaedcf96898d944cfa3b02f0723915b6f61ee9e696c5dd0e9d33051781635c3f1f227eb1a248
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
360KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
228KB
-
Filesize
420KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
228KB
-
Filesize
56KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
2.3MB