Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/09/2026, 03:32
General
- Target jaffacakes118__1edbe72e21f6cc2fc6d4e68a86f5c743.exe
- Size 242KB
- Sample260921-d33dbavv6k
- SHA256 d78d9e9998c9f533749111e5e68a5ed4fae798e9cb68a8b072c18b8fff827eea
Malware Config
Signatures
- Family: Simda, Shiz
Simda aka Shiz is a stealer and backdoor written in C++.
- Detects Simda aka Shiz backdoor 7 IoCs
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies WinLogon 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__1edbe72e21f6cc2fc6d4e68a86f5c743.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__1edbe72e21f6cc2fc6d4e68a86f5c743.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
memory/4204-0-0x0000000002370000-0x00000000023D7000-memory.dmp
memory/4204-9-0x0000000002370000-0x00000000023D7000-memory.dmp
memory/4204-8-0x0000000000400000-0x0000000000472000-memory.dmp
memory/4420-45-0x0000000005980000-0x0000000005981000-memory.dmp
memory/4420-39-0x0000000005940000-0x0000000005941000-memory.dmp
memory/4420-18-0x0000000004040000-0x00000000040DF000-memory.dmp
memory/4420-15-0x0000000004040000-0x00000000040DF000-memory.dmp
memory/4420-27-0x0000000005900000-0x0000000005901000-memory.dmp
memory/4420-31-0x0000000005920000-0x0000000005921000-memory.dmp
memory/4420-32-0x0000000005910000-0x0000000005911000-memory.dmp
memory/4420-49-0x0000000004040000-0x00000000040DF000-memory.dmp
memory/4420-48-0x0000000005990000-0x0000000005991000-memory.dmp
memory/4420-46-0x0000000005970000-0x0000000005971000-memory.dmp
memory/4420-11-0x0000000000E80000-0x0000000000F10000-memory.dmp
memory/4420-14-0x0000000004040000-0x00000000040DF000-memory.dmp
memory/4420-41-0x0000000005960000-0x0000000005961000-memory.dmp
memory/4420-38-0x0000000005950000-0x0000000005951000-memory.dmp
memory/4420-34-0x0000000005930000-0x0000000005931000-memory.dmp
memory/4420-35-0x0000000005940000-0x0000000005941000-memory.dmp
memory/4420-28-0x0000000005910000-0x0000000005911000-memory.dmp
memory/4420-25-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/4420-24-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/4420-23-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/4420-21-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/4420-20-0x0000000004040000-0x00000000040DF000-memory.dmp
memory/4420-43-0x0000000005970000-0x0000000005971000-memory.dmp
memory/4420-51-0x0000000000400000-0x0000000000472000-memory.dmp