Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_0f7f7ec9c469f0b7839ad8da6b4d0c97cd05fe18cc99099a7bf4ce62cff18daa

  • Size

    159KB

  • Sample

    241222-lt1r5atnbm

  • MD5

    e54caf8c5b1fefb3289f1c743775a7f7

  • SHA1

    9af113a01ef46432502ab37f61e7a8fa15479a7a

  • SHA256

    0f7f7ec9c469f0b7839ad8da6b4d0c97cd05fe18cc99099a7bf4ce62cff18daa

  • SHA512

    fef0022c4d1f2c85adec44138ef89e1a2bd6117892dc1ebf5d21866828b3c3c7d0f5fdb97f5b2d965873aca280a923e781ea3c69988fd6b43c5f55b9bc1becc3

  • SSDEEP

    3072:J7+69EJhEjeblBHZ57ODtgNQT0kP+NN34Pu3/d042XL:FEJhEjeRV7ODMkP+NK2d0P

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Targets

    • Target

      JaffaCakes118_0f7f7ec9c469f0b7839ad8da6b4d0c97cd05fe18cc99099a7bf4ce62cff18daa

    • Size

      159KB

    • MD5

      e54caf8c5b1fefb3289f1c743775a7f7

    • SHA1

      9af113a01ef46432502ab37f61e7a8fa15479a7a

    • SHA256

      0f7f7ec9c469f0b7839ad8da6b4d0c97cd05fe18cc99099a7bf4ce62cff18daa

    • SHA512

      fef0022c4d1f2c85adec44138ef89e1a2bd6117892dc1ebf5d21866828b3c3c7d0f5fdb97f5b2d965873aca280a923e781ea3c69988fd6b43c5f55b9bc1becc3

    • SSDEEP

      3072:J7+69EJhEjeblBHZ57ODtgNQT0kP+NN34Pu3/d042XL:FEJhEjeRV7ODMkP+NK2d0P

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks