Analysis

  • max time kernel
    144s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 03:35

General

  • Target

    82ea87954b04fc372f6d7742c9a8c1ba_JaffaCakes118.exe

  • Size

    142KB

  • MD5

    82ea87954b04fc372f6d7742c9a8c1ba

  • SHA1

    3a5a3225a254b8439f4b47547cee90693fe54d71

  • SHA256

    c9bb0f5190af364135375275be990f63233814ea6fab7ddaa4b2d21895945077

  • SHA512

    98b62922cdd6fc243a4d1fe7ad2da5d71f11f8d6b92193d093dadd8cce9a240dbd5eae3b07c432c6b2ab5ff549946bc89d1bb8f025b1f409df74bcdd00f673c3

  • SSDEEP

    3072:kO8/FLfgT6rzTkYfiL2+jKfgi4m5nuGFU6W6WNE6b3U:w9NzwFLnKP46uC

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82ea87954b04fc372f6d7742c9a8c1ba_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\82ea87954b04fc372f6d7742c9a8c1ba_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bgdtqtr\
      2⤵
        PID:2812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gdoauvz.exe" C:\Windows\SysWOW64\bgdtqtr\
        2⤵
          PID:2552
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create bgdtqtr binPath= "C:\Windows\SysWOW64\bgdtqtr\gdoauvz.exe /d\"C:\Users\Admin\AppData\Local\Temp\82ea87954b04fc372f6d7742c9a8c1ba_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:2492
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description bgdtqtr "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2452
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start bgdtqtr
          2⤵
          • Launches sc.exe
          PID:2596
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2500
      • C:\Windows\SysWOW64\bgdtqtr\gdoauvz.exe
        C:\Windows\SysWOW64\bgdtqtr\gdoauvz.exe /d"C:\Users\Admin\AppData\Local\Temp\82ea87954b04fc372f6d7742c9a8c1ba_JaffaCakes118.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          PID:2348

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\gdoauvz.exe

        Filesize

        12.3MB

        MD5

        30b90c103c212d5356c3bb3668667ecf

        SHA1

        a48da1ad1f29393b4f42d5dfadf6017b773b22e3

        SHA256

        372fddb77ada78a866de6476e035aa7d389b29faab25f0b1a01a41c3a0af6bd0

        SHA512

        3f06da29aff3cafc3d9188a49c6f108e6834b69fba9bffe873d2aba1c80c3dc9dab26ce3308fbe1e9d4ffd5fbe4555f0d3f4722cb23ce6c169c62456738140d3

      • memory/2008-0-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2008-2-0x0000000000270000-0x0000000000271000-memory.dmp

        Filesize

        4KB

      • memory/2008-1-0x0000000000260000-0x0000000000261000-memory.dmp

        Filesize

        4KB

      • memory/2008-7-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2348-11-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/2348-13-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/2348-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2348-8-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/2348-15-0x0000000000090000-0x00000000000A5000-memory.dmp

        Filesize

        84KB

      • memory/2788-6-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB

      • memory/2788-14-0x0000000000400000-0x0000000000426000-memory.dmp

        Filesize

        152KB