Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2024, 01:26

General

  • Target

    JaffaCakes118_bd4d0182cbd50f08d157f51f241c28b6645982d32dd1dd30a8c78e121d85726e.exe

  • Size

    285KB

  • MD5

    25c149a1f5f4a036ebb72773167bedff

  • SHA1

    b431e0f8cc073569c13889b0a4a13a982f47573a

  • SHA256

    bd4d0182cbd50f08d157f51f241c28b6645982d32dd1dd30a8c78e121d85726e

  • SHA512

    6dfb3c62eb5c2f781da664db27b4821e3fca799b3d1a09825be1ace7a7ba9290fa06d2e7cb2867b1aefc7d88547539c2580ad1d7d016e93ac753b0fe08e3f63c

  • SSDEEP

    6144:IW+6iIKmVsp07lkCPkcPI1NSIuSYG5RG:NVTCkI1YnG+

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Tofsee family
  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd4d0182cbd50f08d157f51f241c28b6645982d32dd1dd30a8c78e121d85726e.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd4d0182cbd50f08d157f51f241c28b6645982d32dd1dd30a8c78e121d85726e.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rsthmxmm\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4424
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\horpqqgu.exe" C:\Windows\SysWOW64\rsthmxmm\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3372
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" create rsthmxmm binPath= "C:\Windows\SysWOW64\rsthmxmm\horpqqgu.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd4d0182cbd50f08d157f51f241c28b6645982d32dd1dd30a8c78e121d85726e.exe\"" type= own start= auto DisplayName= "wifi support"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:184
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" description rsthmxmm "wifi internet conection"
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:3292
    • C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe" start rsthmxmm
      2⤵
      • Launches sc.exe
      • System Location Discovery: System Language Discovery
      PID:2368
    • C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4608
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 668
      2⤵
      • Program crash
      PID:1368
  • C:\Windows\SysWOW64\rsthmxmm\horpqqgu.exe
    C:\Windows\SysWOW64\rsthmxmm\horpqqgu.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_bd4d0182cbd50f08d157f51f241c28b6645982d32dd1dd30a8c78e121d85726e.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Sets service image path in registry
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 528
      2⤵
      • Program crash
      PID:1556
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4480 -ip 4480
    1⤵
      PID:1676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1288 -ip 1288
      1⤵
        PID:4420

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\horpqqgu.exe

        Filesize

        14.2MB

        MD5

        1e52fe56bb9843b885d2672ef4339275

        SHA1

        1a79ec90f1fd642c061495e0f156e5b505e933c4

        SHA256

        52af71a1e03686f1d204ee87fefafdbeff6eac735dd8096e4bda1ae414580641

        SHA512

        41d460304d1f7fc4a77f1013fdf67e86ef6756d61fde1c8bc5631aa6f62fb527d8b5c3e5e58a861489d772be4558952e23996d81f7faf26f9f26e370eb8f61ac

      • memory/232-14-0x0000000000A60000-0x0000000000A75000-memory.dmp

        Filesize

        84KB

      • memory/232-17-0x0000000000A60000-0x0000000000A75000-memory.dmp

        Filesize

        84KB

      • memory/232-16-0x0000000000A60000-0x0000000000A75000-memory.dmp

        Filesize

        84KB

      • memory/1288-13-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

      • memory/1288-12-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

      • memory/1288-11-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

      • memory/1288-18-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

      • memory/4480-9-0x0000000002060000-0x0000000002073000-memory.dmp

        Filesize

        76KB

      • memory/4480-8-0x0000000000400000-0x0000000000454000-memory.dmp

        Filesize

        336KB

      • memory/4480-1-0x0000000000460000-0x0000000000560000-memory.dmp

        Filesize

        1024KB

      • memory/4480-10-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/4480-3-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/4480-2-0x0000000002060000-0x0000000002073000-memory.dmp

        Filesize

        76KB