Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 21:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe
-
Size
238KB
-
MD5
1854bf09896c03053dbc0a9bb214d346
-
SHA1
7b5744d026e9a5f7965f1ebf3625070c638ea2ef
-
SHA256
a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3
-
SHA512
d261cd4150e913e7944df01592b255b021a51ecd2f6054f1db326acdd31b4b85989ae09221509e03977320d44e8f94dd2e05f9c3af48bbc009d93f9e6cde4cc4
-
SSDEEP
6144:pNeWb3UACOZBOzSc1OItX7ITsq7igavwVf:pN9b37tZBkvnX79
Malware Config
Extracted
tofsee
quadoil.ru
lakeflex.ru
Signatures
-
Tofsee family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\wlbllxiq = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2776 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wlbllxiq\ImagePath = "C:\\Windows\\SysWOW64\\wlbllxiq\\fgeorkpa.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2132 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2228 fgeorkpa.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2228 set thread context of 2132 2228 fgeorkpa.exe 43 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1256 sc.exe 1816 sc.exe 1084 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fgeorkpa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2348 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 30 PID 2312 wrote to memory of 2348 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 30 PID 2312 wrote to memory of 2348 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 30 PID 2312 wrote to memory of 2348 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 30 PID 2312 wrote to memory of 1948 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 32 PID 2312 wrote to memory of 1948 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 32 PID 2312 wrote to memory of 1948 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 32 PID 2312 wrote to memory of 1948 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 32 PID 2312 wrote to memory of 1084 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 34 PID 2312 wrote to memory of 1084 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 34 PID 2312 wrote to memory of 1084 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 34 PID 2312 wrote to memory of 1084 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 34 PID 2312 wrote to memory of 1256 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 36 PID 2312 wrote to memory of 1256 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 36 PID 2312 wrote to memory of 1256 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 36 PID 2312 wrote to memory of 1256 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 36 PID 2312 wrote to memory of 1816 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 38 PID 2312 wrote to memory of 1816 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 38 PID 2312 wrote to memory of 1816 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 38 PID 2312 wrote to memory of 1816 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 38 PID 2312 wrote to memory of 2776 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 41 PID 2312 wrote to memory of 2776 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 41 PID 2312 wrote to memory of 2776 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 41 PID 2312 wrote to memory of 2776 2312 JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe 41 PID 2228 wrote to memory of 2132 2228 fgeorkpa.exe 43 PID 2228 wrote to memory of 2132 2228 fgeorkpa.exe 43 PID 2228 wrote to memory of 2132 2228 fgeorkpa.exe 43 PID 2228 wrote to memory of 2132 2228 fgeorkpa.exe 43 PID 2228 wrote to memory of 2132 2228 fgeorkpa.exe 43 PID 2228 wrote to memory of 2132 2228 fgeorkpa.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wlbllxiq\2⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fgeorkpa.exe" C:\Windows\SysWOW64\wlbllxiq\2⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create wlbllxiq binPath= "C:\Windows\SysWOW64\wlbllxiq\fgeorkpa.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1084
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description wlbllxiq "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1256
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start wlbllxiq2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1816
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2776
-
-
C:\Windows\SysWOW64\wlbllxiq\fgeorkpa.exeC:\Windows\SysWOW64\wlbllxiq\fgeorkpa.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a76073552688bcc6ca3de18c2e7e2394bfb2b3808f8a7d66f51e331373d332f3.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD59bd594a57f1cf1e8a747d88fc82c730b
SHA1fadb13bd79f6557d642a2407b84ec978462e9fe4
SHA2562569f0a51376d0c977099cbeb060ee0307cc7b45b59f7d9b4cadd70f5f5d48b6
SHA512ca52f29a28c8b211378a101a4365fc63e34d0a1e71d53eb2dadd836539f1a87bc65d66a9d454ff29c7eb6dc52241f4045c95d1f3a3b5028a5669a0f701faa060