General
-
Target
JaffaCakes118_9bc9e8366b832675f4dfbbd0282309b9a5574ff3077f09a0c7c7833323c3da56
-
Size
327KB
-
Sample
241226-2s1czatphp
-
MD5
b35f2909e897463c416785bdcde42493
-
SHA1
bac8e6f9c56d963e7409640b91761090079f2fa3
-
SHA256
9bc9e8366b832675f4dfbbd0282309b9a5574ff3077f09a0c7c7833323c3da56
-
SHA512
6a0e7b2948e5f97228806392fc7a2456ae7df14494823e2570b4fd4fe90cae137610031a31b51acfac6de8d889c5a114548f447c0aa88b17c1e019e29acbc033
-
SSDEEP
6144:q5CPb057QUO6Tnp5+5aMIerb1us61S8T8Cvo:D0RQUOqnp5Uaferbs1tTl
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_9bc9e8366b832675f4dfbbd0282309b9a5574ff3077f09a0c7c7833323c3da56.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_9bc9e8366b832675f4dfbbd0282309b9a5574ff3077f09a0c7c7833323c3da56.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
tofsee
quadoil.ru
lakeflex.ru
Targets
-
-
Target
JaffaCakes118_9bc9e8366b832675f4dfbbd0282309b9a5574ff3077f09a0c7c7833323c3da56
-
Size
327KB
-
MD5
b35f2909e897463c416785bdcde42493
-
SHA1
bac8e6f9c56d963e7409640b91761090079f2fa3
-
SHA256
9bc9e8366b832675f4dfbbd0282309b9a5574ff3077f09a0c7c7833323c3da56
-
SHA512
6a0e7b2948e5f97228806392fc7a2456ae7df14494823e2570b4fd4fe90cae137610031a31b51acfac6de8d889c5a114548f447c0aa88b17c1e019e29acbc033
-
SSDEEP
6144:q5CPb057QUO6Tnp5+5aMIerb1us61S8T8Cvo:D0RQUOqnp5Uaferbs1tTl
-
Tofsee family
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2