tofsee | ec5cea05b159118d15e30332109ff78852184c3136919be4cdf67d9f0159caad

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe
Size 11.7MB
Sample240403-c9z14aea82
SHA256 ec5cea05b159118d15e30332109ff78852184c3136919be4cdf67d9f0159caad
MD5 9e007ace1a924b46a8b29f38d36d652d
SHA1 df87d776d7b0d7a03e3b1e1a6e5464b1fda8bbce
SHA512 ce5af61f0d51f6706e600115ecd04a92e364699172ce14d7757e1839d6c6f1f77c94d31424ebc0c6308cab31b2a8cf2a2714a60ce516ebbd0076afa682aa8fe0
SSDEEP 196608:COOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOu:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3240	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jbzhgxdc\ImagePath = "C:\\Windows\\SysWOW64\\jbzhgxdc\\blqdkfet.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3224	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2500	blqdkfet.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 3224	2500	blqdkfet.exe	117

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3604	sc.exe
1928	sc.exe
4200	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1512	3696	WerFault.exe	90
4396	2500	WerFault.exe	109

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1468	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	97
PID 3696 wrote to memory of 1468	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	97
PID 3696 wrote to memory of 1468	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	97
PID 3696 wrote to memory of 3780	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	100
PID 3696 wrote to memory of 3780	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	100
PID 3696 wrote to memory of 3780	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	100
PID 3696 wrote to memory of 3604	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	102
PID 3696 wrote to memory of 3604	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	102
PID 3696 wrote to memory of 3604	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	102
PID 3696 wrote to memory of 1928	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	104
PID 3696 wrote to memory of 1928	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	104
PID 3696 wrote to memory of 1928	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	104
PID 3696 wrote to memory of 4200	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	107
PID 3696 wrote to memory of 4200	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	107
PID 3696 wrote to memory of 4200	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	107
PID 3696 wrote to memory of 3240	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	110
PID 3696 wrote to memory of 3240	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	110
PID 3696 wrote to memory of 3240	3696	9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe	110
PID 2500 wrote to memory of 3224	2500	blqdkfet.exe	117
PID 2500 wrote to memory of 3224	2500	blqdkfet.exe	117
PID 2500 wrote to memory of 3224	2500	blqdkfet.exe	117
PID 2500 wrote to memory of 3224	2500	blqdkfet.exe	117
PID 2500 wrote to memory of 3224	2500	blqdkfet.exe	117

C:\Users\Admin\AppData\Local\Temp\9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jbzhgxdc\
  2⤵
  PID:1468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\blqdkfet.exe" C:\Windows\SysWOW64\jbzhgxdc\
  2⤵
  PID:3780
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create jbzhgxdc binPath= "C:\Windows\SysWOW64\jbzhgxdc\blqdkfet.exe /d\"C:\Users\Admin\AppData\Local\Temp\9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:3604
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description jbzhgxdc "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1928
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start jbzhgxdc
  2⤵
  - Launches sc.exe
  PID:4200
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 1036
  2⤵
  - Program crash
  PID:1512

C:\Windows\SysWOW64\jbzhgxdc\blqdkfet.exe
C:\Windows\SysWOW64\jbzhgxdc\blqdkfet.exe /d"C:\Users\Admin\AppData\Local\Temp\9e007ace1a924b46a8b29f38d36d652d_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:3224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 524
  2⤵
  - Program crash
  PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3696 -ip 3696
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2500 -ip 2500
1⤵
PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2240,i,16875000905773190493,11379096115878622792,262144 --variations-seed-version /prefetch:8
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blqdkfet.exe

Path C:\Users\Admin\AppData\Local\Temp\blqdkfet.exe
Size 10.9MB
SHA256 1a8c735bfaf561120c6e422fb22a012592de19079ad9f1438cf749ad8f9e1d7c
MD5 9eb26438c6bf7415fb7371c536283386
SHA1 41592d1b99c81c9bc807588250378cec0bef5e1c
SHA512 a369808b53e8d74764ae669c6cd9574d4e8d97252eb0da95f199fea9d527cba003b7ebfb6ba262c6f5949f293dc544e9461027ecfd1205c44cbb9eacecc8c324
SSDEEP 196608:IOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOy:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2500-10-0x0000000002F50000-0x0000000003050000-memory.dmp

Download

memory/2500-17-0x0000000000400000-0x0000000002F11000-memory.dmp

Download

memory/2500-19-0x0000000000400000-0x0000000002F11000-memory.dmp

Download

memory/2500-15-0x0000000000400000-0x0000000002F11000-memory.dmp

Download

memory/3224-14-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Download

memory/3224-11-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Download

memory/3224-16-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Download

memory/3224-18-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Download

memory/3224-20-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Download

memory/3696-1-0x0000000002FD0000-0x00000000030D0000-memory.dmp

Download

memory/3696-4-0x0000000000400000-0x0000000002F11000-memory.dmp

Download

memory/3696-9-0x00000000030E0000-0x00000000030F3000-memory.dmp

Download

memory/3696-8-0x0000000000400000-0x0000000002F11000-memory.dmp

Download

memory/3696-2-0x00000000030E0000-0x00000000030F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads