tofsee | d78572878d5938a7c8b52be86a4b2c5f879fdea5f4004c2db0277050ccfb015a

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe
Size 11.6MB
Sample240403-a6f3psaf91
SHA256 d78572878d5938a7c8b52be86a4b2c5f879fdea5f4004c2db0277050ccfb015a
MD5 9ba5b14b096ac13d7e127953f6688d02
SHA1 d41f16bcd9945adc787b8e5e0e5faf0f10045386
SHA512 0f74486807b959893b06cb89bb53d07142940dff2ac03c98483735320e9926ad0e62a41e06025a5fa70e079d59d2cb5a118e6c9ee3f41f0567fd15eecf260bcb
SSDEEP 12288:KQeoegEG/Rl1M7jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj:KQeGX1M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3356	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\llzvrplh\ImagePath = "C:\\Windows\\SysWOW64\\llzvrplh\\cjvirefz.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2800	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4308	cjvirefz.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4308 set thread context of 2800	4308	cjvirefz.exe	108

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2280	sc.exe
2608	sc.exe
1688	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1792	5012	WerFault.exe	84
2488	4308	WerFault.exe	101

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1692	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	88
PID 5012 wrote to memory of 1692	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	88
PID 5012 wrote to memory of 1692	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	88
PID 5012 wrote to memory of 3868	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	90
PID 5012 wrote to memory of 3868	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	90
PID 5012 wrote to memory of 3868	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	90
PID 5012 wrote to memory of 2280	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	92
PID 5012 wrote to memory of 2280	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	92
PID 5012 wrote to memory of 2280	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	92
PID 5012 wrote to memory of 2608	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	96
PID 5012 wrote to memory of 2608	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	96
PID 5012 wrote to memory of 2608	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	96
PID 5012 wrote to memory of 1688	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	98
PID 5012 wrote to memory of 1688	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	98
PID 5012 wrote to memory of 1688	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	98
PID 5012 wrote to memory of 3356	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	102
PID 5012 wrote to memory of 3356	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	102
PID 5012 wrote to memory of 3356	5012	9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe	102
PID 4308 wrote to memory of 2800	4308	cjvirefz.exe	108
PID 4308 wrote to memory of 2800	4308	cjvirefz.exe	108
PID 4308 wrote to memory of 2800	4308	cjvirefz.exe	108
PID 4308 wrote to memory of 2800	4308	cjvirefz.exe	108
PID 4308 wrote to memory of 2800	4308	cjvirefz.exe	108

C:\Users\Admin\AppData\Local\Temp\9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\llzvrplh\
  2⤵
  PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cjvirefz.exe" C:\Windows\SysWOW64\llzvrplh\
  2⤵
  PID:3868
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create llzvrplh binPath= "C:\Windows\SysWOW64\llzvrplh\cjvirefz.exe /d\"C:\Users\Admin\AppData\Local\Temp\9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2280
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description llzvrplh "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2608
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start llzvrplh
  2⤵
  - Launches sc.exe
  PID:1688
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 1044
  2⤵
  - Program crash
  PID:1792

C:\Windows\SysWOW64\llzvrplh\cjvirefz.exe
C:\Windows\SysWOW64\llzvrplh\cjvirefz.exe /d"C:\Users\Admin\AppData\Local\Temp\9ba5b14b096ac13d7e127953f6688d02_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 184
  2⤵
  - Program crash
  PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5012 -ip 5012
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 4308
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cjvirefz.exe

Path C:\Users\Admin\AppData\Local\Temp\cjvirefz.exe
Size 12.9MB
SHA256 d3bbfd31664f4ed3ff58f35ca36fff7f24d35887e84027f0433610a3d247b062
MD5 fc8f9f6b0a7f01f6920fe5bd9093c33e
SHA1 19925f2b064d3470044e1086d64da8e6bed4f444
SHA512 021b28f6e368466540655ff5476d8035b269d2fda018e18a030d38cc06378bd11d7fb91911c45dde70f688d9223adb4891af3df13caf4a9d3e9c03cfb7cefa4c
SSDEEP 12288:5QeoegEG/Rl1M7jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj3:5QeGX1M
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2800-15-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/2800-12-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/2800-16-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/2800-17-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/2800-19-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/4308-10-0x0000000000B60000-0x0000000000C60000-memory.dmp

Download

memory/4308-11-0x0000000000400000-0x000000000086A000-memory.dmp

Download

memory/4308-18-0x0000000000400000-0x000000000086A000-memory.dmp

Download

memory/5012-4-0x0000000000400000-0x000000000086A000-memory.dmp

Download

memory/5012-2-0x0000000000AD0000-0x0000000000AE3000-memory.dmp

Download

memory/5012-8-0x0000000000400000-0x000000000086A000-memory.dmp

Download

memory/5012-9-0x0000000000AD0000-0x0000000000AE3000-memory.dmp

Download

memory/5012-1-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads