Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
-
submitted
12-02-2025 14:14
General
-
Target
JaffaCakes118_f0e9b3529943f87927fceb023884d1b1.exe
-
Size
266KB
-
MD5
f0e9b3529943f87927fceb023884d1b1
-
SHA1
51bac0f6a569d3579933214641eb9b9293f06463
-
SHA256
cd161d0c6063a660be6cf30549df81ead3e6ba156287cd8fa8caddcee445b47c
-
SHA512
e21f6e4080588cf84644b8cf8615551de8245252bfa806207d84e44be7d72298653de9d23ede87c2652b66572b9eb6ef4b10f5c4bdb8cee3a22e15f4e160be43
-
SSDEEP
6144:ep/jck02ek7v8VjWHJll+s/EyZ+2Wv52AFovNH/mLkGu:I/jJ02r7qWplOk+OAF8NOLK
Malware Config
Extracted
simda
-
dga
cihunemyror.eu
digivehusyd.eu
vofozymufok.eu
fodakyhijyv.eu
nopegymozow.eu
gatedyhavyd.eu
marytymenok.eu
jewuqyjywyv.eu
qeqinuqypoq.eu
kemocujufys.eu
rynazuqihoj.eu
lyvejujolec.eu
tucyguqaciq.eu
xuxusujenes.eu
puzutuqeqij.eu
ciliqikytec.eu
dikoniwudim.eu
vojacikigep.eu
fogeliwokih.eu
nofyjikoxex.eu
gadufiwabim.eu
masisokemep.eu
jepororyrih.eu
qetoqolusex.eu
keraborigin.eu
ryqecolijet.eu
lymylorozig.eu
tunujolavez.eu
xubifaremin.eu
puvopalywet.eu
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file 1 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 26 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
System policy modification 1 TTPs 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f0e9b3529943f87927fceb023884d1b1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f0e9b3529943f87927fceb023884d1b1.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjlDNjM3QTEtMzc0OC00QkM4LUJEQTAtQjgxNTA1QTY1MkY2fSIgdXNlcmlkPSJ7ODc0RDg4NjYtRUI1QS00N0I1LUEyNkUtOUZDRThBMzhFNUZDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTBFMjcwNEYtMjE0NS00MkExLTk5QTctQkRFMzhCQ0M4NzQ4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODM0MTAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NTUzNjg2NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MTIxODM4NTU0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\MicrosoftEdge_X64_133.0.3065.59.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\MicrosoftEdge_X64_133.0.3065.59.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff77ea86a68,0x7ff77ea86a74,0x7ff77ea86a803⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0709C68-22AB-49B3-8E02-9BB5237B8B7B}\EDGEMITMP_FE00D.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff77ea86a68,0x7ff77ea86a74,0x7ff77ea86a804⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff64d436a68,0x7ff64d436a74,0x7ff64d436a804⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff64d436a68,0x7ff64d436a74,0x7ff64d436a804⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.60 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.59\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.59 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff64d436a68,0x7ff64d436a74,0x7ff64d436a804⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch1⤵
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD51b3e9c59f9c7a134ec630ada1eb76a39
SHA1a7e831d392e99f3d37847dcc561dd2e017065439
SHA256ce78ccfb0c9cdb06ea61116bc57e50690650b6b5cf37c1aebfb30c19458ee4ae
SHA512c0e50410dc92d80ff7bc854907774fc551564e078a8d38ca6421f15cea50282c25efac4f357b52b066c4371f9b8d4900fa8122dd80ab06ecbd851c6e049f7a3e
-
Filesize
3.9MB
MD5ad5f7dc7ca3e67dce70c0a89c04519e0
SHA1a10b03234627ca8f3f8034cd5637cda1b8246d83
SHA256663fe0f4e090583e6aa5204b9a80b7a76f677259066e56a7345aebc6bc3e7d31
SHA512ad5490e9865caa454c47ec2e96364b9c566b553e64801da60c295acd570017747be1aff6f22ca6c20c6eee6f6d05a058af72569fd6e656f66e48010978c7fd51
-
Filesize
73KB
MD533e6e640f588c86dd83f8553f526a7b1
SHA18be56bbdb86237703ed99517c0ccf1242c85d9e7
SHA256fcc8ea1a96f07ba7a4ad2c5b7f947662df612f406539825f01bf9bafaeb46ab2
SHA51215500762e27dd2328b55f56899244529390a1483f35a3a7009ac600c06940b6b105ba8050c2ff8ebf2d44ea74455b0626ff3fb06d3707ecb792a125c2c0064d2
-
Filesize
98KB
MD5cfd1f4ce49528e7eb5d77525e7d4d92b
SHA1acddbc10189332dc090c1ac3d6d156687673e369
SHA2565bc1c90579e699df1df264a9ef0010615bbeca3b0d35b530d7119b5aca32f55c
SHA5125d5f909571187810422733cffc64678773d4995fe04a1414539593c73524ab8d19a559a2b0423a0cd843475f6c557c52f71cf885b8177ab8c1c9d6aba39e19ed
-
Filesize
102KB
MD550db94417515ac1521ff183c2df539a2
SHA12d61fb6660d090d4d699e324f898a50737403385
SHA25693ef0a9b595151d1c16fcee82c99d6debefe702d2027c16ff2d5676af5069a0b
SHA512f9caab249f8a0d99e582110b1c2a95ecca909cbd68436ebba2147bc5ab98b136054df4f8997ff45615d07a5261deed35e98b8e50aa00bacbbb3ec6d125282bb8
-
Filesize
104KB
MD5ccd5d78c3880093b38fd885d46c4331f
SHA110afbdc5fa1f3af88a29130c1a7e0b2c54d46ebe
SHA2564e32d52740ac5e26c55f432d2add4737b773e00d7185ae42b273575eecc17487
SHA512236f7e7309fe298c1088cbfb1bd3263d762b99904afb3f5ecedc3316a24db54f910ab19b15010c249fa5100b75fdd12474766925476608259b7890d022765a05
-
Filesize
2.3MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
560KB
-
Filesize
228KB
-
Filesize
420KB
-
Filesize
560KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
228KB