Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_aea58b6cb75a81c29db530feb8f1bbf0f15c7727ee0264877bc6fc80b5fc8b65

  • Size

    177KB

  • Sample

    241227-b18ffayjgk

  • MD5

    54f2cea10632e47ab38d113d587ce32c

  • SHA1

    f3f5d9d585045d0c51ac741605a3ae990719db02

  • SHA256

    aea58b6cb75a81c29db530feb8f1bbf0f15c7727ee0264877bc6fc80b5fc8b65

  • SHA512

    e460a1aa990ee7fb908c9b44a79dc648e7f9a58362e45a05a592642026452aa8790993d782a41f97c8757aba05a611cbf6fd2ddebc41f9501e0198c2c4e05fac

  • SSDEEP

    3072:F7ea06Z4EKxA+xZGkXL09dtE03aotb1dSVcsV93:66CEKxA+y9dtE27gV93

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Targets

    • Target

      JaffaCakes118_aea58b6cb75a81c29db530feb8f1bbf0f15c7727ee0264877bc6fc80b5fc8b65

    • Size

      177KB

    • MD5

      54f2cea10632e47ab38d113d587ce32c

    • SHA1

      f3f5d9d585045d0c51ac741605a3ae990719db02

    • SHA256

      aea58b6cb75a81c29db530feb8f1bbf0f15c7727ee0264877bc6fc80b5fc8b65

    • SHA512

      e460a1aa990ee7fb908c9b44a79dc648e7f9a58362e45a05a592642026452aa8790993d782a41f97c8757aba05a611cbf6fd2ddebc41f9501e0198c2c4e05fac

    • SSDEEP

      3072:F7ea06Z4EKxA+xZGkXL09dtE03aotb1dSVcsV93:66CEKxA+y9dtE27gV93

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks