Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe
-
Size
285KB
-
MD5
af9e5d753d03655da119c7e35cb59c5f
-
SHA1
e2797ebf86a7d535cfebd2f3ff6ab022d7888aaf
-
SHA256
b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f
-
SHA512
93b09c81dcab40163afa8c75835b4bbcb5a87d378bbd7cccdc2fc96257c44b3882c1ab9b7ed14027d43ab10b5c00fb52d2bb2aedaa2c356697b69d0e317e2b99
-
SSDEEP
6144:ANXxcSzbHJgv0pc+mNAArvCkSIbceTdp45YakI/:ANXKsbHCcpWuaTJHpHav/
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Tofsee family
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2928 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\drasoyow\ImagePath = "C:\\Windows\\SysWOW64\\drasoyow\\wzxsmtdn.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe -
Deletes itself 1 IoCs
pid Process 4640 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3896 wzxsmtdn.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3896 set thread context of 4640 3896 wzxsmtdn.exe 95 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4892 sc.exe 1732 sc.exe 1644 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wzxsmtdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2644 wrote to memory of 3936 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 82 PID 2644 wrote to memory of 3936 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 82 PID 2644 wrote to memory of 3936 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 82 PID 2644 wrote to memory of 1976 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 84 PID 2644 wrote to memory of 1976 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 84 PID 2644 wrote to memory of 1976 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 84 PID 2644 wrote to memory of 4892 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 86 PID 2644 wrote to memory of 4892 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 86 PID 2644 wrote to memory of 4892 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 86 PID 2644 wrote to memory of 1732 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 88 PID 2644 wrote to memory of 1732 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 88 PID 2644 wrote to memory of 1732 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 88 PID 2644 wrote to memory of 1644 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 90 PID 2644 wrote to memory of 1644 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 90 PID 2644 wrote to memory of 1644 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 90 PID 2644 wrote to memory of 2928 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 93 PID 2644 wrote to memory of 2928 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 93 PID 2644 wrote to memory of 2928 2644 JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe 93 PID 3896 wrote to memory of 4640 3896 wzxsmtdn.exe 95 PID 3896 wrote to memory of 4640 3896 wzxsmtdn.exe 95 PID 3896 wrote to memory of 4640 3896 wzxsmtdn.exe 95 PID 3896 wrote to memory of 4640 3896 wzxsmtdn.exe 95 PID 3896 wrote to memory of 4640 3896 wzxsmtdn.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\drasoyow\2⤵
- System Location Discovery: System Language Discovery
PID:3936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wzxsmtdn.exe" C:\Windows\SysWOW64\drasoyow\2⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create drasoyow binPath= "C:\Windows\SysWOW64\drasoyow\wzxsmtdn.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4892
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description drasoyow "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1732
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start drasoyow2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1644
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2928
-
-
C:\Windows\SysWOW64\drasoyow\wzxsmtdn.exeC:\Windows\SysWOW64\drasoyow\wzxsmtdn.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b78bfeec5a89e18c0d6b3cb94bc55cebfb00b3391cc1d0ad6d1ae45e85e0782f.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:4640
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.3MB
MD5604dad2cfe0e2dd86906d56160896c59
SHA1560327afc349d58b3ee719c034873755e16d4f0d
SHA25603517ee6774999f3707fd0db1dfe319003a9552a6eae4a102a24a9919e4f2f70
SHA512ac71f63674152a1b77037b8766bf478da8d281fbeb8a7fe009954636dd5e58d1df599973570d9b6f812fa717c0427f1d63e105df6132f200b0e13094488f84a6