tofsee | 3ef291e4dc9f5a6e42ae653acae1e014e90bf658c4160f6e8de7f2e4b0538460

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe
Size

10.5MB
MD5

026f086162e7d6d864ca4dc744149bc0
SHA1

cc81af6e0d8bd8c89126f509ccb5714cce8a3ef0
SHA256

3ef291e4dc9f5a6e42ae653acae1e014e90bf658c4160f6e8de7f2e4b0538460
SHA512

ff7ba4526233eb5a7e6dfa4673bfe0dc9b354a9960c23822267cab62c1571139e93c3919d8bf38bd1afd58b147ea15a2fdc1ad6b92f2e0fd2e65b14847cdebf4
SSDEEP

49152:DkHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

quadoil.ru

lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dqmlcwv = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2716	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dqmlcwv\ImagePath = "C:\\Windows\\SysWOW64\\dqmlcwv\\yhqymemv.exe"	svchost.exe

Deletes itself 1 IoCs

pid	Process
2312	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	yhqymemv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2312	2664	yhqymemv.exe	41

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2712	sc.exe
2532	sc.exe
2776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2032	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	28
PID 2252 wrote to memory of 2032	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	28
PID 2252 wrote to memory of 2032	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	28
PID 2252 wrote to memory of 2032	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	28
PID 2252 wrote to memory of 2684	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2684	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2684	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2684	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	30
PID 2252 wrote to memory of 2712	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	32
PID 2252 wrote to memory of 2712	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	32
PID 2252 wrote to memory of 2712	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	32
PID 2252 wrote to memory of 2712	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	32
PID 2252 wrote to memory of 2532	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	34
PID 2252 wrote to memory of 2532	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	34
PID 2252 wrote to memory of 2532	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	34
PID 2252 wrote to memory of 2532	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	34
PID 2252 wrote to memory of 2776	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	36
PID 2252 wrote to memory of 2776	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	36
PID 2252 wrote to memory of 2776	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	36
PID 2252 wrote to memory of 2776	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	36
PID 2252 wrote to memory of 2716	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	39
PID 2252 wrote to memory of 2716	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	39
PID 2252 wrote to memory of 2716	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	39
PID 2252 wrote to memory of 2716	2252	026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe	39
PID 2664 wrote to memory of 2312	2664	yhqymemv.exe	41
PID 2664 wrote to memory of 2312	2664	yhqymemv.exe	41
PID 2664 wrote to memory of 2312	2664	yhqymemv.exe	41
PID 2664 wrote to memory of 2312	2664	yhqymemv.exe	41
PID 2664 wrote to memory of 2312	2664	yhqymemv.exe	41
PID 2664 wrote to memory of 2312	2664	yhqymemv.exe	41

C:\Users\Admin\AppData\Local\Temp\026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dqmlcwv\
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yhqymemv.exe" C:\Windows\SysWOW64\dqmlcwv\
  2⤵
  PID:2684
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create dqmlcwv binPath= "C:\Windows\SysWOW64\dqmlcwv\yhqymemv.exe /d\"C:\Users\Admin\AppData\Local\Temp\026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2712
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description dqmlcwv "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2532
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start dqmlcwv
  2⤵
  - Launches sc.exe
  PID:2776
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2716

C:\Windows\SysWOW64\dqmlcwv\yhqymemv.exe
C:\Windows\SysWOW64\dqmlcwv\yhqymemv.exe /d"C:\Users\Admin\AppData\Local\Temp\026f086162e7d6d864ca4dc744149bc0_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\yhqymemv.exe

Filesize
10.5MB

MD5
8170a4fad9eac75e899d68057e9db7e0

SHA1
757cc8a8be053370c14d07b26ff0015872750a0a

SHA256
f51747fcea242b3c5be5fb3dcdd9ccc0ad24cfaea882f077cb26aca80dcc930a

SHA512
ce035cf364e2a187edfa54a73f1d9daea2ae968aa21d827778576fa0af03db55720903f2d3a1c067b516ebcf207ecb880d424819f27c23a48801f02d1e838b60

Download Submit
C:\Windows\SysWOW64\dqmlcwv\yhqymemv.exe

Filesize
8.4MB

MD5
3f27498158869382834d0ebd70770105

SHA1
7c0dd9d73c87f9369e825230fcfb6af15f69c4a9

SHA256
b286faed2569f59e321a40f088196a80983ceca9be8e36582d94d7990f0f4e2a

SHA512
6c724c0e87a4073f2205285159d05556cadecf5629810b5777439390c487e7a7a74d4a03b426cb032387b0e550ea0b5652c6f71b2c4dcb1de9a41d0e170c00c7

Download Submit
memory/2252-1-0x0000000000860000-0x0000000000960000-memory.dmp

Filesize
1024KB

Download
memory/2252-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2252-4-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/2252-8-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/2312-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2312-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2312-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2312-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2312-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2312-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2664-10-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/2664-12-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/2664-16-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads