tofsee | 2d2f3834995473d4666f0631ecc070cedeec7989335f3c6bbab27d97a7bec42c

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe
Size 14.8MB
Sample240328-phs5paaa59
SHA256 2d2f3834995473d4666f0631ecc070cedeec7989335f3c6bbab27d97a7bec42c
MD5 056cf3551e97f490b0369c619be2eebe
SHA1 e1f3c0c1e9e24829c4d8429162ab42ff4742236a
SHA512 23fb64872da0d92c0366159e225f6b7e2a8baa499791212d22f5a81a32433fabed02adb76cf3d38d45e4181a22e0eb71cef3e58f0416a55cb9efd7d109361de3
SSDEEP 6144:whs/wyHHRdbJ9yTwvobkepF5b3pi2+ETJcyIjh:whsYyHHRdbTyUwDpF515+ETN8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5372	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mitcvlwc\ImagePath = "C:\\Windows\\SysWOW64\\mitcvlwc\\iettyflc.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2508	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
964	iettyflc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 964 set thread context of 2508	964	iettyflc.exe	109

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5456	sc.exe
4840	sc.exe
1568	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5080	1008	WerFault.exe	85
1244	964	WerFault.exe	101

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 5228	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	89
PID 1008 wrote to memory of 5228	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	89
PID 1008 wrote to memory of 5228	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	89
PID 1008 wrote to memory of 4624	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	91
PID 1008 wrote to memory of 4624	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	91
PID 1008 wrote to memory of 4624	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	91
PID 1008 wrote to memory of 5456	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	93
PID 1008 wrote to memory of 5456	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	93
PID 1008 wrote to memory of 5456	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	93
PID 1008 wrote to memory of 4840	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	97
PID 1008 wrote to memory of 4840	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	97
PID 1008 wrote to memory of 4840	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	97
PID 1008 wrote to memory of 1568	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	99
PID 1008 wrote to memory of 1568	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	99
PID 1008 wrote to memory of 1568	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	99
PID 1008 wrote to memory of 5372	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	103
PID 1008 wrote to memory of 5372	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	103
PID 1008 wrote to memory of 5372	1008	056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe	103
PID 964 wrote to memory of 2508	964	iettyflc.exe	109
PID 964 wrote to memory of 2508	964	iettyflc.exe	109
PID 964 wrote to memory of 2508	964	iettyflc.exe	109
PID 964 wrote to memory of 2508	964	iettyflc.exe	109
PID 964 wrote to memory of 2508	964	iettyflc.exe	109

C:\Users\Admin\AppData\Local\Temp\056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mitcvlwc\
  2⤵
  PID:5228
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iettyflc.exe" C:\Windows\SysWOW64\mitcvlwc\
  2⤵
  PID:4624
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create mitcvlwc binPath= "C:\Windows\SysWOW64\mitcvlwc\iettyflc.exe /d\"C:\Users\Admin\AppData\Local\Temp\056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:5456
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description mitcvlwc "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4840
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start mitcvlwc
  2⤵
  - Launches sc.exe
  PID:1568
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:5372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 1236
  2⤵
  - Program crash
  PID:5080

C:\Windows\SysWOW64\mitcvlwc\iettyflc.exe
C:\Windows\SysWOW64\mitcvlwc\iettyflc.exe /d"C:\Users\Admin\AppData\Local\Temp\056cf3551e97f490b0369c619be2eebe_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2508
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 508
  2⤵
  - Program crash
  PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1008 -ip 1008
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 964 -ip 964
1⤵
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iettyflc.exe

Path C:\Users\Admin\AppData\Local\Temp\iettyflc.exe
Size 13.7MB
SHA256 9bc21a5ed7a30cfcf3c2104d94fc3e09d433f48c3068af29dccc5140fee766ad
MD5 ac2059c57ffb6925d96b9e7b990c3e37
SHA1 e7319dbad75dc4518b24a39fe5c4436ea5222aa3
SHA512 a2c32e9410465cf8f973f436f077fc198579cde0853682270e73411af012b068c8ca18fb1c40f79a589bfde800ee9a79b49650a02aebc232a42c1edad9dbf934
SSDEEP 6144:4hs/wyHHRdbJ9yTwvobkepF5b3pi2+ETJcyIjh:4hsYyHHRdbTyUwDpF515+ETN8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/964-10-0x0000000001750000-0x0000000001850000-memory.dmp

Download

memory/964-13-0x0000000000400000-0x00000000016C0000-memory.dmp

Download

memory/964-16-0x0000000000400000-0x00000000016C0000-memory.dmp

Download

memory/1008-4-0x0000000000400000-0x00000000016C0000-memory.dmp

Download

memory/1008-2-0x0000000003400000-0x0000000003413000-memory.dmp

Download

memory/1008-8-0x0000000000400000-0x00000000016C0000-memory.dmp

Download

memory/1008-9-0x0000000003400000-0x0000000003413000-memory.dmp

Download

memory/1008-1-0x0000000001780000-0x0000000001880000-memory.dmp

Download

memory/2508-11-0x0000000000EC0000-0x0000000000ED5000-memory.dmp

Download

memory/2508-15-0x0000000000EC0000-0x0000000000ED5000-memory.dmp

Download

memory/2508-17-0x0000000000EC0000-0x0000000000ED5000-memory.dmp

Download

memory/2508-18-0x0000000000EC0000-0x0000000000ED5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads