tofsee | 1664045584a46d45955ee6a8d0d47df589837c609232653413c515fc3e4bca62

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe
Size 11.7MB
Sample240328-l7gleafh79
SHA256 1664045584a46d45955ee6a8d0d47df589837c609232653413c515fc3e4bca62
MD5 02dc80cd9cf3cff7d95588655037c2f2
SHA1 af16e4d5e970f82047ddb1bcf79b7fea1d1883a5
SHA512 cd97ca0c06a2d584b1417173db00def9b70dcfec97e699648bd0fec4f6378b93915dfa2b8abc5bbe211dbcbb92992ee6337755de03c1fcc8da06763e8f5d2123
SSDEEP 49152:+xYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYD:+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4500	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lgclxqyh\ImagePath = "C:\\Windows\\SysWOW64\\lgclxqyh\\mfamqfq.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3720	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	mfamqfq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4844 set thread context of 3720	4844	mfamqfq.exe	108

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1476	sc.exe
2076	sc.exe
2604	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2364	384	WerFault.exe	84
3380	4844	WerFault.exe	102

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3480	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	88
PID 384 wrote to memory of 3480	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	88
PID 384 wrote to memory of 3480	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	88
PID 384 wrote to memory of 1996	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	92
PID 384 wrote to memory of 1996	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	92
PID 384 wrote to memory of 1996	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	92
PID 384 wrote to memory of 1476	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	94
PID 384 wrote to memory of 1476	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	94
PID 384 wrote to memory of 1476	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	94
PID 384 wrote to memory of 2076	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	97
PID 384 wrote to memory of 2076	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	97
PID 384 wrote to memory of 2076	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	97
PID 384 wrote to memory of 2604	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	100
PID 384 wrote to memory of 2604	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	100
PID 384 wrote to memory of 2604	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	100
PID 384 wrote to memory of 4500	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	103
PID 384 wrote to memory of 4500	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	103
PID 384 wrote to memory of 4500	384	02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe	103
PID 4844 wrote to memory of 3720	4844	mfamqfq.exe	108
PID 4844 wrote to memory of 3720	4844	mfamqfq.exe	108
PID 4844 wrote to memory of 3720	4844	mfamqfq.exe	108
PID 4844 wrote to memory of 3720	4844	mfamqfq.exe	108
PID 4844 wrote to memory of 3720	4844	mfamqfq.exe	108

C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lgclxqyh\
  2⤵
  PID:3480
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mfamqfq.exe" C:\Windows\SysWOW64\lgclxqyh\
  2⤵
  PID:1996
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create lgclxqyh binPath= "C:\Windows\SysWOW64\lgclxqyh\mfamqfq.exe /d\"C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1476
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description lgclxqyh "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2076
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start lgclxqyh
  2⤵
  - Launches sc.exe
  PID:2604
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 384 -s 1184
  2⤵
  - Program crash
  PID:2364

C:\Windows\SysWOW64\lgclxqyh\mfamqfq.exe
C:\Windows\SysWOW64\lgclxqyh\mfamqfq.exe /d"C:\Users\Admin\AppData\Local\Temp\02dc80cd9cf3cff7d95588655037c2f2_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 516
  2⤵
  - Program crash
  PID:3380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 384 -ip 384
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4844 -ip 4844
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mfamqfq.exe

Path C:\Users\Admin\AppData\Local\Temp\mfamqfq.exe
Size 423KB
SHA256 fb31d7070284e90db1cf8d53cad560d54632bf77323a80ae2da117aea105f4d8
MD5 215a0f5c014ec3ca25db7bb722768f2a
SHA1 cd051cf203926b5e1b309c5851b85d970ac5be5d
SHA512 eb56e409e267e5adfd5fcbafa9126da0087d983a8051cd2a66fd05c644941eb85bda2fce040c4e7c401b8411703184eefe93e0d3519bad7963b0ed5c6c94695f
SSDEEP 6144:FS0IHkhNZzDNF/uOlWD+cmR/HvgRSLYYY:U0IHkhNhP/uOlWhmR/PUSLYYY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfamqfq.exe

Path C:\Windows\SysWOW64\lgclxqyh\mfamqfq.exe
Size 10.2MB
SHA256 424b4aaadde02017dbf2333d3c4b60054101bfd3cd946e780ff1c14b5bf6eb1e
MD5 17d138a8d6cc3001f75359bb544fadb5
SHA1 b685a39a70eb1b99fd1bef46e292fb6eee7c0643
SHA512 d2bc1797cc35dca6f7712b16b4e30ce79cad1b75747604cc96e41f5e1260771cae6ea1a43024a64a1d79c3717c7cebaa62bb44a01472bb5bfb39395bf880a384
SSDEEP 49152:XxYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY4:X
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/384-9-0x0000000001820000-0x0000000001833000-memory.dmp

Download

memory/384-4-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/384-2-0x0000000001820000-0x0000000001833000-memory.dmp

Download

memory/384-8-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/384-1-0x00000000018E0000-0x00000000019E0000-memory.dmp

Download

memory/3720-11-0x00000000012B0000-0x00000000012C5000-memory.dmp

Download

memory/3720-15-0x00000000012B0000-0x00000000012C5000-memory.dmp

Download

memory/3720-16-0x00000000012B0000-0x00000000012C5000-memory.dmp

Download

memory/3720-17-0x00000000012B0000-0x00000000012C5000-memory.dmp

Download

memory/3720-19-0x00000000012B0000-0x00000000012C5000-memory.dmp

Download

memory/4844-10-0x0000000001800000-0x0000000001900000-memory.dmp

Download

memory/4844-12-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/4844-18-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads