Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 10:35
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe
-
Size
12.8MB
-
MD5
5dfcaf4e5871ac873611bd6f471ef2fc
-
SHA1
4e629c67eea486e000f176945c1432db02ff762d
-
SHA256
f4cfa45ff195fb3fe470b75d9d3c8b6d8a8d8741a6e1401ba5eb494c27dd4090
-
SHA512
b949db654cc28ae03a1e83953fe608a3990b5dc37d9145ca011d4ba43f0d1d0bc54c18a7c85f648b141230db65d4168701a0ccd0d151ce71b2d4071b201684cb
-
SSDEEP
6144:kNvMXNc7x72uNJFeTgkYIvpjkHp2e7z+/uyAmMGwDkqyyyyyyyyyyyyyyyyyyyyi:kNvM9i7fNJFeTgk9BjkHp2Euu1mr
Malware Config
Extracted
tofsee
quadoil.ru
lakeflex.ru
Signatures
-
Tofsee family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\esnjjlbb = "0" svchost.exe -
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2600 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\esnjjlbb\ImagePath = "C:\\Windows\\SysWOW64\\esnjjlbb\\wxvfibgr.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2636 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2840 wxvfibgr.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2840 set thread context of 2636 2840 wxvfibgr.exe 43 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2760 sc.exe 2568 sc.exe 2800 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wxvfibgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2240 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 30 PID 3028 wrote to memory of 2240 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 30 PID 3028 wrote to memory of 2240 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 30 PID 3028 wrote to memory of 2240 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 30 PID 3028 wrote to memory of 2664 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 32 PID 3028 wrote to memory of 2664 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 32 PID 3028 wrote to memory of 2664 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 32 PID 3028 wrote to memory of 2664 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 32 PID 3028 wrote to memory of 2760 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 34 PID 3028 wrote to memory of 2760 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 34 PID 3028 wrote to memory of 2760 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 34 PID 3028 wrote to memory of 2760 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 34 PID 3028 wrote to memory of 2568 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 36 PID 3028 wrote to memory of 2568 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 36 PID 3028 wrote to memory of 2568 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 36 PID 3028 wrote to memory of 2568 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 36 PID 3028 wrote to memory of 2800 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 38 PID 3028 wrote to memory of 2800 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 38 PID 3028 wrote to memory of 2800 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 38 PID 3028 wrote to memory of 2800 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 38 PID 3028 wrote to memory of 2600 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 41 PID 3028 wrote to memory of 2600 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 41 PID 3028 wrote to memory of 2600 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 41 PID 3028 wrote to memory of 2600 3028 JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe 41 PID 2840 wrote to memory of 2636 2840 wxvfibgr.exe 43 PID 2840 wrote to memory of 2636 2840 wxvfibgr.exe 43 PID 2840 wrote to memory of 2636 2840 wxvfibgr.exe 43 PID 2840 wrote to memory of 2636 2840 wxvfibgr.exe 43 PID 2840 wrote to memory of 2636 2840 wxvfibgr.exe 43 PID 2840 wrote to memory of 2636 2840 wxvfibgr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\esnjjlbb\2⤵
- System Location Discovery: System Language Discovery
PID:2240
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wxvfibgr.exe" C:\Windows\SysWOW64\esnjjlbb\2⤵
- System Location Discovery: System Language Discovery
PID:2664
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create esnjjlbb binPath= "C:\Windows\SysWOW64\esnjjlbb\wxvfibgr.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2760
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description esnjjlbb "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2568
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start esnjjlbb2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2800
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2600
-
-
C:\Windows\SysWOW64\esnjjlbb\wxvfibgr.exeC:\Windows\SysWOW64\esnjjlbb\wxvfibgr.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dfcaf4e5871ac873611bd6f471ef2fc.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.2MB
MD5fd35a954f6ef58000c7fd30b0be6191d
SHA1a86588311578d7c5149b7dc904d86532855e2f7b
SHA256a41fc76f7c7c362dfc6413358f5f108359087da11223ae1333a9869ace3bf055
SHA5124db0f0460fa9b8d6db83274800ec799bd5aa382b659760a0fbe36196eda98b954c2d3ba7e4b69fb245b6261641994b93e0035be04dc2c6dc9714e506866cbf68