Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-04-2024 22:09

General

  • Target

    f209de2b20a674e93e3296af504c17cd_JaffaCakes118.exe

  • Size

    11.7MB

  • MD5

    f209de2b20a674e93e3296af504c17cd

  • SHA1

    7226e347ec585b1cc46cbb043ded6a49f571c805

  • SHA256

    c95876b37d090034446c2d94dae77ffd8eda405ea99b333285491d67fa4fa757

  • SHA512

    1b7d954fa8a118503a7816ba394136a8055bd6d2fe6d2d650088750b4d35973227e15781e41ce044fbc151e7f833e6d7c381ab9acf48aa4e77e47c77566b6d92

  • SSDEEP

    12288:Ge/GBGOCZ7s3WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWy:EIdZ7

Malware Config

Extracted

Family

tofsee

C2

176.111.174.19

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f209de2b20a674e93e3296af504c17cd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f209de2b20a674e93e3296af504c17cd_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mjcjszbd\
      2⤵
        PID:2052
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\maqatfeh.exe" C:\Windows\SysWOW64\mjcjszbd\
        2⤵
          PID:4004
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create mjcjszbd binPath= "C:\Windows\SysWOW64\mjcjszbd\maqatfeh.exe /d\"C:\Users\Admin\AppData\Local\Temp\f209de2b20a674e93e3296af504c17cd_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1928
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description mjcjszbd "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1436
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start mjcjszbd
          2⤵
          • Launches sc.exe
          PID:4432
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2512
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 1248
          2⤵
          • Program crash
          PID:1580
      • C:\Windows\SysWOW64\mjcjszbd\maqatfeh.exe
        C:\Windows\SysWOW64\mjcjszbd\maqatfeh.exe /d"C:\Users\Admin\AppData\Local\Temp\f209de2b20a674e93e3296af504c17cd_JaffaCakes118.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1336
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          PID:1196
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1336 -s 524
          2⤵
          • Program crash
          PID:2336
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2656 -ip 2656
        1⤵
          PID:2360
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1336 -ip 1336
          1⤵
            PID:4708

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\maqatfeh.exe

            Filesize

            14.1MB

            MD5

            f36cd1d93a222b78bf32d05b7d820289

            SHA1

            f8500ac62f6c7a655a89b9bb8d68a405852e3c9c

            SHA256

            c06e5b561a3ff819f4791bab50e33333cb2b5f059c00b18b2793dfa8f00f9707

            SHA512

            ddb41c71c4608ef50d0740b3af58bea07abe63f82e1df0203e8177ca5a5f14b2f645da8d3d975940b65e63d3bd56a78584d5eac660c06179a7d0f0087e86bef9

          • memory/1196-16-0x00000000001D0000-0x00000000001E5000-memory.dmp

            Filesize

            84KB

          • memory/1196-11-0x00000000001D0000-0x00000000001E5000-memory.dmp

            Filesize

            84KB

          • memory/1196-17-0x00000000001D0000-0x00000000001E5000-memory.dmp

            Filesize

            84KB

          • memory/1196-19-0x00000000001D0000-0x00000000001E5000-memory.dmp

            Filesize

            84KB

          • memory/1336-10-0x0000000002D40000-0x0000000002E40000-memory.dmp

            Filesize

            1024KB

          • memory/1336-14-0x0000000000400000-0x0000000002BF6000-memory.dmp

            Filesize

            40.0MB

          • memory/1336-18-0x0000000000400000-0x0000000002BF6000-memory.dmp

            Filesize

            40.0MB

          • memory/2656-4-0x0000000000400000-0x0000000002BF6000-memory.dmp

            Filesize

            40.0MB

          • memory/2656-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

            Filesize

            76KB

          • memory/2656-8-0x0000000000400000-0x0000000002BF6000-memory.dmp

            Filesize

            40.0MB

          • memory/2656-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

            Filesize

            76KB

          • memory/2656-1-0x0000000002D90000-0x0000000002E90000-memory.dmp

            Filesize

            1024KB