General
-
Target
JaffaCakes118_a9785cc2161ee3a09be004bc8346b6d121beaee526de903c66e465178b39471d
-
Size
153KB
-
Sample
241222-ffnmratqcz
-
MD5
18e44b2036f311423755b28f21676f82
-
SHA1
34fffe3ca810d3a4850e60b108bf8b0d140f2c9d
-
SHA256
a9785cc2161ee3a09be004bc8346b6d121beaee526de903c66e465178b39471d
-
SHA512
927baa57a78dc23f6b9f64cc3fd693db79f7580dd906c6cdebb88a7d539ceede2a5583b8bf15e91d162d3b66833bf568f55b48557466af33f281e80548521126
-
SSDEEP
1536:g3XTaOHdVEPuyp3GwwsMoqOhvQ87hKWng68gp5ZSuxgRJ355VfyvPt/CD6H:gzamdxyDwGr7hK4z8gp5iL35r6v0O
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a9785cc2161ee3a09be004bc8346b6d121beaee526de903c66e465178b39471d.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_a9785cc2161ee3a09be004bc8346b6d121beaee526de903c66e465178b39471d.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Targets
-
-
Target
JaffaCakes118_a9785cc2161ee3a09be004bc8346b6d121beaee526de903c66e465178b39471d
-
Size
153KB
-
MD5
18e44b2036f311423755b28f21676f82
-
SHA1
34fffe3ca810d3a4850e60b108bf8b0d140f2c9d
-
SHA256
a9785cc2161ee3a09be004bc8346b6d121beaee526de903c66e465178b39471d
-
SHA512
927baa57a78dc23f6b9f64cc3fd693db79f7580dd906c6cdebb88a7d539ceede2a5583b8bf15e91d162d3b66833bf568f55b48557466af33f281e80548521126
-
SSDEEP
1536:g3XTaOHdVEPuyp3GwwsMoqOhvQ87hKWng68gp5ZSuxgRJ355VfyvPt/CD6H:gzamdxyDwGr7hK4z8gp5iL35r6v0O
-
Tofsee family
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2