General
-
Target
JaffaCakes118_798ae701056c5af507b179f0be77b7ee4148f3d1b12cf20758dd13cf0c5708bb
-
Size
211KB
-
Sample
241229-gve5lavlfq
-
MD5
ffffbcff20fb800fd3f9eead8cc301d6
-
SHA1
8107208c9d533b474c2ada975607857445bb4b25
-
SHA256
798ae701056c5af507b179f0be77b7ee4148f3d1b12cf20758dd13cf0c5708bb
-
SHA512
ee99f55075f9597d3bebf79ff6fbd80ab002c3d730e050c6d579a90855e1af7ce6850238d2579c58c5d6f610df4fcb025c4c5411b3e2bd8ff9dd1a467d70ef13
-
SSDEEP
3072:UXbDiQngH/AxJ9M12IJZ2L088qxwuqH/pxAATTgmsrZrZPwpVWLQhgC:UXbBgYxjaZ2LJhCBxOHryWQ
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_798ae701056c5af507b179f0be77b7ee4148f3d1b12cf20758dd13cf0c5708bb.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_798ae701056c5af507b179f0be77b7ee4148f3d1b12cf20758dd13cf0c5708bb.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Targets
-
-
Target
JaffaCakes118_798ae701056c5af507b179f0be77b7ee4148f3d1b12cf20758dd13cf0c5708bb
-
Size
211KB
-
MD5
ffffbcff20fb800fd3f9eead8cc301d6
-
SHA1
8107208c9d533b474c2ada975607857445bb4b25
-
SHA256
798ae701056c5af507b179f0be77b7ee4148f3d1b12cf20758dd13cf0c5708bb
-
SHA512
ee99f55075f9597d3bebf79ff6fbd80ab002c3d730e050c6d579a90855e1af7ce6850238d2579c58c5d6f610df4fcb025c4c5411b3e2bd8ff9dd1a467d70ef13
-
SSDEEP
3072:UXbDiQngH/AxJ9M12IJZ2L088qxwuqH/pxAATTgmsrZrZPwpVWLQhgC:UXbBgYxjaZ2LJhCBxOHryWQ
-
Tofsee family
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2