General

  • Target

    JaffaCakes118_fa05264100e8f110940bb4132f9f9e18

  • Size

    267KB

  • Sample

    250214-vh77havmhw

  • MD5

    fa05264100e8f110940bb4132f9f9e18

  • SHA1

    0f286ebd4a48a0f68b0de52f93329807d869777d

  • SHA256

    d160e6c91029935be6e1c62c7942b8fdd178b11b7525ef7f9965addcf9a82d97

  • SHA512

    a26c536e492696af45abd63f5cfd62beac1cc7b56c757ea44860f5d076bf0af66b509a2794c8a14a1d1b5efa0b2771e62aac5cd40b954d18326a7b679d9d89e4

  • SSDEEP

    6144:A9+j1NrPtqmhLOXg83y2WC3d1uf5vQiZKD1dxp/s4:AYllzhLOXr3vW2MfpJZKVpB

Malware Config

Extracted

Family

simda

Attributes
  • dga

    cihunemyror.eu

    digivehusyd.eu

    vofozymufok.eu

    fodakyhijyv.eu

    nopegymozow.eu

    gatedyhavyd.eu

    marytymenok.eu

    jewuqyjywyv.eu

    qeqinuqypoq.eu

    kemocujufys.eu

    rynazuqihoj.eu

    lyvejujolec.eu

    tucyguqaciq.eu

    xuxusujenes.eu

    puzutuqeqij.eu

    ciliqikytec.eu

    dikoniwudim.eu

    vojacikigep.eu

    fogeliwokih.eu

    nofyjikoxex.eu

    gadufiwabim.eu

    masisokemep.eu

    jepororyrih.eu

    qetoqolusex.eu

    keraborigin.eu

    ryqecolijet.eu

    lymylorozig.eu

    tunujolavez.eu

    xubifaremin.eu

    puvopalywet.eu

Targets

    • Target

      JaffaCakes118_fa05264100e8f110940bb4132f9f9e18

    • Size

      267KB

    • MD5

      fa05264100e8f110940bb4132f9f9e18

    • SHA1

      0f286ebd4a48a0f68b0de52f93329807d869777d

    • SHA256

      d160e6c91029935be6e1c62c7942b8fdd178b11b7525ef7f9965addcf9a82d97

    • SHA512

      a26c536e492696af45abd63f5cfd62beac1cc7b56c757ea44860f5d076bf0af66b509a2794c8a14a1d1b5efa0b2771e62aac5cd40b954d18326a7b679d9d89e4

    • SSDEEP

      6144:A9+j1NrPtqmhLOXg83y2WC3d1uf5vQiZKD1dxp/s4:AYllzhLOXr3vW2MfpJZKVpB

    • Modifies WinLogon for persistence

    • Simda family

    • simda

      Simda is an infostealer written in C++.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Modifies WinLogon

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks