tofsee | 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51

General

Target

048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe
Size

142KB
MD5

048725634c77ed7223cd9b91d90b172b
SHA1

40628d5ffe1bbd7915a628938a8acac0d9c77ba3
SHA256

568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51
SHA512

ad87648a4003832c7ec6129b2745c119c693f99628295cb318d285b8c5ca23d8ec0a4682fdbe3e8a880de0f6e9b84ed78ae3279c457477d5d6a2b27f1284446c
SSDEEP

3072:Urmeq2+/v4ZyY6yZHeLZVDZrHEzgGQNZ2uZlanCt:U6hy5cXZrHRlNou/anC

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3460 netsh.exe

pid	process
3460	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\kvnsswpd\ImagePath = "C:\\Windows\\SysWOW64\\kvnsswpd\\ecqcdywc.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4600 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

ecqcdywc.exe

pid process

4916 ecqcdywc.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ecqcdywc.exe

description pid process target process

PID 4916 set thread context of 4600 4916 ecqcdywc.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3196 sc.exe
4964 sc.exe
3024 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4600	svchost.exe

pid	process
4916	ecqcdywc.exe

description	pid	process	target process
PID 4916 set thread context of 4600	4916	ecqcdywc.exe	svchost.exe

pid	process
3196	sc.exe
4964	sc.exe
3024	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exeecqcdywc.exe

description	pid	process	target process
PID 2300 wrote to memory of 4152	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 4152	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 4152	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 2208	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 2208	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 2208	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 3196	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3196	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3196	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 4964	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 4964	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 4964	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3024	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3024	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3024	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3460	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	netsh.exe
PID 2300 wrote to memory of 3460	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	netsh.exe
PID 2300 wrote to memory of 3460	2300	048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe	netsh.exe
PID 4916 wrote to memory of 4600	4916	ecqcdywc.exe	svchost.exe
PID 4916 wrote to memory of 4600	4916	ecqcdywc.exe	svchost.exe
PID 4916 wrote to memory of 4600	4916	ecqcdywc.exe	svchost.exe
PID 4916 wrote to memory of 4600	4916	ecqcdywc.exe	svchost.exe
PID 4916 wrote to memory of 4600	4916	ecqcdywc.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kvnsswpd\
2⤵
PID:4152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ecqcdywc.exe" C:\Windows\SysWOW64\kvnsswpd\
2⤵
PID:2208

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create kvnsswpd binPath= "C:\Windows\SysWOW64\kvnsswpd\ecqcdywc.exe /d\"C:\Users\Admin\AppData\Local\Temp\048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:3196

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description kvnsswpd "wifi internet conection"
2⤵
- Launches sc.exe
PID:4964

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start kvnsswpd
2⤵
- Launches sc.exe
PID:3024

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:3460

C:\Windows\SysWOW64\kvnsswpd\ecqcdywc.exe
C:\Windows\SysWOW64\kvnsswpd\ecqcdywc.exe /d"C:\Users\Admin\AppData\Local\Temp\048725634c77ed7223cd9b91d90b172b_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ecqcdywc.exe
Filesize
14.7MB

MD5
53051f6b080cba19b0013b9867034ca1

SHA1
06ee07c3cd0db9ee3839c92a18e09cfd55f8d4fb

SHA256
3fda8c82e0ac6427da28bd4b83478227055c099df07eb87e2d7b92455483c763

SHA512
ac99f0644ec6653f9df86cb3110e1a3987275eddb34a311805c46f3009c6c94baf75c98f7cd985d61718ff7d68705bff5cceb5dda475a5d0d7bbe5221e2321f8

Download Submit
memory/2300-0-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2300-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2300-2-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/2300-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4600-8-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Filesize
84KB

Download
memory/4600-11-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Filesize
84KB

Download
memory/4600-12-0x0000000000AB0000-0x0000000000AC5000-memory.dmp

Filesize
84KB

Download
memory/4916-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4916-9-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads