Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21/02/2025, 20:21
General
-
Target
JaffaCakes118_15088060803b442e613555cbc9ac8694.exe
-
Size
213KB
-
MD5
15088060803b442e613555cbc9ac8694
-
SHA1
8959637a65a8b5210ed123c4422ee2e775113ccd
-
SHA256
d36f483eaf0f3f98f66d4738a7b70c93f082e0f0d0ecd04e662cca31d4cfbd92
-
SHA512
d737c702787e59085076fbef776fb42de3e51d2dc3beb8d0f77e5b98154913a0682418dba487a03d6a9bc421f58391d801bdbe94ffa80d8b4b0a85c7c3434ed1
-
SSDEEP
6144:/Gxy3+HKsBHem6VqgCvehxcgKS54S5UEuU:uvqS+vmsci58e
Malware Config
Extracted
simda
-
dga
gatyfus.com
lyvyxor.com
vojyqem.com
qetyfuv.com
puvyxil.com
gahyqah.com
lyryfyd.com
vocyzit.com
qegyqaq.com
purydyv.com
gacyzuz.com
lygymoj.com
vowydef.com
qexylup.com
pufymoq.com
gaqydeb.com
lyxylux.com
vofymik.com
qeqysag.com
puzylyp.com
gadyniw.com
lymysan.com
volykyc.com
qedynul.com
pumypog.com
galykes.com
lysynur.com
vonypom.com
qekykev.com
pupybul.com
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15088060803b442e613555cbc9ac8694.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_15088060803b442e613555cbc9ac8694.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5f7dfd4469153e9e275c075d720e2b261
SHA11fe9451815efbb28497668867137f49618117ef4
SHA2567f6bf160944bb70b9c2a91ad41cd71b8b79f0a3dfd8fb2c17aa1da0a20248d24
SHA5124476529d333f68d6587693b7ead95136c8013c9df8fe2e6ad3e0717f8b4d34c559855a38b7312cc0644eed9b435638fb17efeb3062d255ac8ef9add508bc0a6f
-
Filesize
2KB
MD5f3381b1e6b02ece47069144f60278e7f
SHA159b69fe74f723687c0c48e8cef80bface0b9022c
SHA2564c041c289dab59d90cfed952343976cfc4ddfbf34cd20f402419cdfe90350c4a
SHA512a14fb6e6785a1a1c64aa262f55c6a8b29fd8d84e0bf7ef18bbae872903d177070d0765224d5c429b3fe4efa60be5ea11e8896c08362b922d9c2a4ea690e71728
-
Filesize
42KB
MD52a65302d283bfc7f75aa727e80de1d21
SHA1b9fbf5f54943edf91bae2d61094cd4565f512ab6
SHA2567fa5c8352eed0dac2fc07663cd1f263c1be43a38bbdb76777da6b42cfb4d2445
SHA5128d2063a10a8f5374ae7a4a01140b0942158871c0a8ebb04bcfba1e4e6c4fc610cc62416fa31bf4fa7ddcf1fe02cc0eebabb902fbe30ffbc61fcefabf6b63fc4e
-
Filesize
481B
MD5440f28f7a065affc29c7d842a30a101a
SHA1f95b05e909a06804a11c13f57d6fa6a5c1d328dd
SHA256976d68dd668aa0d9af4bc024d64d52ec3e5d44d9b6a7bb665b183a6dd91d7b80
SHA5128f331e1027d19375701e1b96f17378b34ea347d65b9b775c7550d368a77e41b4126765be3123fb1c45282a481a9e0fbe84aec418788d2f841c9e494c3e209c41
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
213KB
MD5e69074cfa56874831605022c7d47ebfe
SHA134e8c6ebcb983559205cf50f98533d1f874bb49e
SHA256c4587c065b658eb7a66cafb84d6a0bc584c6b859b1945224add39d6b34e000eb
SHA5128554055ac32e36a07f00578aaf6359cc090784a5c6cd3744dfa6ac9bdfcfd8ba4280dfc92b01da709256ee89f692efd839439113d35e868fe7adb646be0c4535
-
Filesize
12KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
12KB
-
Filesize
424KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
424KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
424KB
-
Filesize
424KB