Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
21/04/2025, 06:14
General
-
Target
JaffaCakes118_c81506616db5716249434501710993ea.exe
-
Size
271KB
-
MD5
c81506616db5716249434501710993ea
-
SHA1
d793e75f8080995e46fdc091b146f11207b0af11
-
SHA256
555c9e0603f8a0844c5c0e7a43676363fc02cb945217b8a77ffd8f86a8794061
-
SHA512
64814530e6c5045504ac11f5b35f55fde41375a39a530e209d26cff0876f8baae093e37e0617728e039bd934aefc76be1d20652da3faa966f81a8fa1a399390f
-
SSDEEP
6144:ETC+lme8mX3yogwtYMJn3Vf9SCpHpXo/dXdfoaj:ER8mXXgM13VfXpJUDj
Malware Config
Extracted
simda
-
dga
cihunemyror.eu
digivehusyd.eu
vofozymufok.eu
fodakyhijyv.eu
nopegymozow.eu
gatedyhavyd.eu
marytymenok.eu
jewuqyjywyv.eu
qeqinuqypoq.eu
kemocujufys.eu
rynazuqihoj.eu
lyvejujolec.eu
tucyguqaciq.eu
xuxusujenes.eu
puzutuqeqij.eu
ciliqikytec.eu
dikoniwudim.eu
vojacikigep.eu
fogeliwokih.eu
nofyjikoxex.eu
gadufiwabim.eu
masisokemep.eu
jepororyrih.eu
qetoqolusex.eu
keraborigin.eu
ryqecolijet.eu
lymylorozig.eu
tunujolavez.eu
xubifaremin.eu
puvopalywet.eu
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Simda family
-
simda
Simda is an infostealer written in C++.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c81506616db5716249434501710993ea.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c81506616db5716249434501710993ea.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_c81506616db5716249434501710993ea.exeC:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
736KB
-
Filesize
228KB
-
Filesize
2.9MB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
228KB