tofsee | 1664045584a46d45955ee6a8d0d47df589837c609232653413c515fc3e4bca62

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/03/2024, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe
Size 11.7MB
Sample240328-l7gleafh79
SHA256 1664045584a46d45955ee6a8d0d47df589837c609232653413c515fc3e4bca62
MD5 02dc80cd9cf3cff7d95588655037c2f2
SHA1 af16e4d5e970f82047ddb1bcf79b7fea1d1883a5
SHA512 cd97ca0c06a2d584b1417173db00def9b70dcfec97e699648bd0fec4f6378b93915dfa2b8abc5bbe211dbcbb92992ee6337755de03c1fcc8da06763e8f5d2123
SSDEEP 49152:+xYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYD:+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\bcxoecgx = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2416	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bcxoecgx\ImagePath = "C:\\Windows\\SysWOW64\\bcxoecgx\\kdoepmfy.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2556	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2544	kdoepmfy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 2556	2544	kdoepmfy.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2588	sc.exe
2576	sc.exe
2388	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3028	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3028	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3028	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	28
PID 2916 wrote to memory of 3028	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	28
PID 2916 wrote to memory of 2900	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2900	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2900	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2900	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2588	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2588	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2588	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2588	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2576	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2576	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2576	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2576	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2388	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2388	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2388	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2388	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2416	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	39
PID 2916 wrote to memory of 2416	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	39
PID 2916 wrote to memory of 2416	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	39
PID 2916 wrote to memory of 2416	2916	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	39
PID 2544 wrote to memory of 2556	2544	kdoepmfy.exe	41
PID 2544 wrote to memory of 2556	2544	kdoepmfy.exe	41
PID 2544 wrote to memory of 2556	2544	kdoepmfy.exe	41
PID 2544 wrote to memory of 2556	2544	kdoepmfy.exe	41
PID 2544 wrote to memory of 2556	2544	kdoepmfy.exe	41
PID 2544 wrote to memory of 2556	2544	kdoepmfy.exe	41

C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bcxoecgx\
  2⤵
  PID:3028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kdoepmfy.exe" C:\Windows\SysWOW64\bcxoecgx\
  2⤵
  PID:2900
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create bcxoecgx binPath= "C:\Windows\SysWOW64\bcxoecgx\kdoepmfy.exe /d\"C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description bcxoecgx "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2576
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start bcxoecgx
  2⤵
  - Launches sc.exe
  PID:2388
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2416

C:\Windows\SysWOW64\bcxoecgx\kdoepmfy.exe
C:\Windows\SysWOW64\bcxoecgx\kdoepmfy.exe /d"C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdoepmfy.exe

Path C:\Users\Admin\AppData\Local\Temp\kdoepmfy.exe
Size 10.1MB
SHA256 a72771bb85d7d41d64e470c6caacc516dd00fa53ef794aefed4d39a4080d75a8
MD5 9bff2b5ebd0e7619a880fa6ba7978eb1
SHA1 c4648310235a8aad4bd0d608e19fc465bb6fd009
SHA512 5b99f86ed57555d75701c727c42ae0b002edfb52d15a5a08671c529c884852165dba1559ab41ef32621128d51e09c79763e2a8608aa2a0edc2e4953f1d1b9562
SSDEEP 49152:4xYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYU:4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2544-10-0x00000000017D0000-0x00000000018D0000-memory.dmp

Download

memory/2544-16-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/2544-17-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/2556-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2556-11-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2556-14-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2556-20-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2556-21-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2556-22-0x0000000000080000-0x0000000000095000-memory.dmp

Download

memory/2916-9-0x00000000001B0000-0x00000000001C3000-memory.dmp

Download

memory/2916-1-0x0000000000270000-0x0000000000370000-memory.dmp

Download

memory/2916-4-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/2916-8-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/2916-2-0x00000000001B0000-0x00000000001C3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads