Analysis
-
max time kernel
133s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
-
submitted
15-02-2025 20:56
General
-
Target
JaffaCakes118_fc642b52f11f7857eb4620e8f03add8b.exe
-
Size
246KB
-
MD5
fc642b52f11f7857eb4620e8f03add8b
-
SHA1
60d8792f98c93a635cfcc4aee9b6193ed2539310
-
SHA256
00e35387efbeebf214bfb3cf993a1e431e35fb3a41f8700865e0106972ff0a55
-
SHA512
36e4b228ae6d2cb60d8ba479e111fbd533dd4cf31dfa9fd31a6a1af5248184abe470ede1f61f325748a810f4ddc905f85915f252be51a0f43396274e537f2631
-
SSDEEP
6144:o+5oGLScwpDXfwjhWQCqSt3ZIXMBygVxYN7T7:oUDED4jhc3ZIXM5Vx+T7
Malware Config
Extracted
simda
-
dga
cihunemyror.eu
digivehusyd.eu
vofozymufok.eu
fodakyhijyv.eu
nopegymozow.eu
gatedyhavyd.eu
marytymenok.eu
jewuqyjywyv.eu
qeqinuqypoq.eu
kemocujufys.eu
rynazuqihoj.eu
lyvejujolec.eu
tucyguqaciq.eu
xuxusujenes.eu
puzutuqeqij.eu
ciliqikytec.eu
dikoniwudim.eu
vojacikigep.eu
fogeliwokih.eu
nofyjikoxex.eu
gadufiwabim.eu
masisokemep.eu
jepororyrih.eu
qetoqolusex.eu
keraborigin.eu
ryqecolijet.eu
lymylorozig.eu
tunujolavez.eu
xubifaremin.eu
puvopalywet.eu
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file 2 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 10 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies Internet Explorer settings 1 TTPs 24 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
System policy modification 1 TTPs 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fc642b52f11f7857eb4620e8f03add8b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fc642b52f11f7857eb4620e8f03add8b.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7ODUxNjUxMjktQjc1NC00RjYwLUE3NkUtMzU4OTMyRDA3OUVFfSIgdXNlcmlkPSJ7Nzk5OEVGMTktRjMyNi00OTY4LUJERTItMjZDRUZGOTY4NEVGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDI1QjFGNkYtRUMyRi00MDNELUEzNTUtNTlBMTRCMDU2NTI5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzYyMTI2OTM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\MicrosoftEdge_X64_133.0.3065.69.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\MicrosoftEdge_X64_133.0.3065.69.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff72ca96a68,0x7ff72ca96a74,0x7ff72ca96a803⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B0DEC8FD-4919-407B-9396-606D957CB519}\EDGEMITMP_E3D95.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff72ca96a68,0x7ff72ca96a74,0x7ff72ca96a804⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6e2856a68,0x7ff6e2856a74,0x7ff6e2856a804⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6e2856a68,0x7ff6e2856a74,0x7ff6e2856a804⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x224,0x228,0x22c,0x100,0x230,0x7ff6e2856a68,0x7ff6e2856a74,0x7ff6e2856a804⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch1⤵
-
C:\Windows\system32\wwahost.exe"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
4Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD5bdb1aecedc15fc82a63083452dad45c2
SHA1a074fcd78665ff90ee3e50ffcccad5f6c3e7ddcb
SHA2564ea0907c3fc2c2f6a4259002312671c82e008846d49957bb3b9915612e35b99f
SHA51250909640c2957fc35dd5bcac3b51797aa5daa2fb95364e69df95d3577482e13f0c36a70ae098959cb9c2aaeb4cfe43025c1d8d55b5f8858b474bcb702609749d
-
Filesize
3.9MB
MD54aaa893417cccc147989f876c6a7b295
SHA1b1e35c83518bb275924ead0cd6206bf0c982d30f
SHA2562c38e3c3f18e2d3fb7f04336356b9b5186cabe06b3343beec318ef0def1a9eeb
SHA512109e0c88977fae65a4950fc38393ca32a70d68ef41aeb75b28e6566e0fa626e32e31be38308e7ed5b6a8ba1f56fb5f2133a07aa8bb643224c3dbb089ce9cfd0e
-
Filesize
74KB
MD584da278c1becb42ca734defa01fa66e2
SHA1716f0c518759957c80b4d833e3cd7f63cdaa54d3
SHA256e6d902309dd02b0ec2d90183d178c4608fa0daca747414d3976d3d9436ee6102
SHA512e4604af25425867c8b7d55bdc3ac00091b22134b9d76a74c4ea74533c6ab068890d9fcd92e659f20bb179a6eaf4813b88976febe2e51380843f89a671d58cd86
-
Filesize
98KB
MD51271be9ab1f020960093fe3e0ba68852
SHA1c03471f0da2cc1b895664b6f9941ff76e1d73d2d
SHA256ddf3ec5e05c57bd2a8e37b2ecad286265e1fcbf45593176594e2629bc6194fb6
SHA51259806b0a3903f1c7365435d8999dc1c38da861c8a12d811c7b860557aff4f902dc17c19a5389a3ec569114d9e62986e518a73e548eaf99e0cd52166afd18d892
-
Filesize
103KB
MD51d4e30d5eb0e0ed6f810010547185803
SHA1b15139e138f12813a47fda934bea4413e3a6830a
SHA2566a046f7d6baa7188ccda2fe425052bafcfa85487f606d91bd44a205d728b87b7
SHA512eee339427f70de6e47968e253ef5ee5e7eefdd1e45837e909962b83c628721d22828650105b501e19381e6b4e6074a9c782a7f4e736db20cc9067438cd855d41
-
Filesize
103KB
MD5ae19f7ec53316852b9b24844049c8da9
SHA184afd6d880b9018de91d9c6862fd95831ae8dfdb
SHA25645f30fcfce3370cfc3278d5bb17229aa2b12a6c7145ee1d38ce3197015501e9c
SHA512547953a33e4605e395ecc9f6519792005eae0941aa60b726ec2766a7769ed4c75e330de8109138660c4dacf1a3b56ae30f8f9a90488197ea56e0fbefb2bf7e8d
-
Filesize
2.3MB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
504KB
-
Filesize
712KB
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
420KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
228KB