tofsee | f06f8570f6999f01ade88f2c09538759e55539eb7c2d452999e1c66ca83e8c02

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe
Size 14.1MB
Sample240405-axyamaff78
SHA256 f06f8570f6999f01ade88f2c09538759e55539eb7c2d452999e1c66ca83e8c02
MD5 c60a9d97501c8fccb7ce37b52654839b
SHA1 94fc047b6307fd89d39eaad454db89dc1d0809c4
SHA512 5254c7f7f7164e27408bdaefe28b948a0b61e576161bd92d0aecefc7b327687e2f10c80ded601fbcfd0d799d887c4b3895e251d3db0a9ef50b3a58086a53ac45
SSDEEP 12288:R0Xz1CuwA5Rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rpZ:R0X2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1836	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cnrlooyw\ImagePath = "C:\\Windows\\SysWOW64\\cnrlooyw\\lomhbisc.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
1136	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	lomhbisc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 1136	2392	lomhbisc.exe	107

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1216	sc.exe
4668	sc.exe
4404	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2820	3916	WerFault.exe	83
1516	2392	WerFault.exe	101

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3536	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	87
PID 3916 wrote to memory of 3536	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	87
PID 3916 wrote to memory of 3536	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	87
PID 3916 wrote to memory of 1280	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	89
PID 3916 wrote to memory of 1280	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	89
PID 3916 wrote to memory of 1280	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	89
PID 3916 wrote to memory of 4404	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	93
PID 3916 wrote to memory of 4404	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	93
PID 3916 wrote to memory of 4404	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	93
PID 3916 wrote to memory of 1216	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	95
PID 3916 wrote to memory of 1216	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	95
PID 3916 wrote to memory of 1216	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	95
PID 3916 wrote to memory of 4668	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	99
PID 3916 wrote to memory of 4668	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	99
PID 3916 wrote to memory of 4668	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	99
PID 3916 wrote to memory of 1836	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	102
PID 3916 wrote to memory of 1836	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	102
PID 3916 wrote to memory of 1836	3916	c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe	102
PID 2392 wrote to memory of 1136	2392	lomhbisc.exe	107
PID 2392 wrote to memory of 1136	2392	lomhbisc.exe	107
PID 2392 wrote to memory of 1136	2392	lomhbisc.exe	107
PID 2392 wrote to memory of 1136	2392	lomhbisc.exe	107
PID 2392 wrote to memory of 1136	2392	lomhbisc.exe	107

C:\Users\Admin\AppData\Local\Temp\c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cnrlooyw\
  2⤵
  PID:3536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lomhbisc.exe" C:\Windows\SysWOW64\cnrlooyw\
  2⤵
  PID:1280
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create cnrlooyw binPath= "C:\Windows\SysWOW64\cnrlooyw\lomhbisc.exe /d\"C:\Users\Admin\AppData\Local\Temp\c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:4404
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description cnrlooyw "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:1216
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start cnrlooyw
  2⤵
  - Launches sc.exe
  PID:4668
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1036
  2⤵
  - Program crash
  PID:2820

C:\Windows\SysWOW64\cnrlooyw\lomhbisc.exe
C:\Windows\SysWOW64\cnrlooyw\lomhbisc.exe /d"C:\Users\Admin\AppData\Local\Temp\c60a9d97501c8fccb7ce37b52654839b_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:1136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 532
  2⤵
  - Program crash
  PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3916 -ip 3916
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2392 -ip 2392
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lomhbisc.exe

Path C:\Users\Admin\AppData\Local\Temp\lomhbisc.exe
Size 14.1MB
SHA256 e734060da35eb401dda9367ce459ba75930064b9c894f57aff9f2409beeac4b8
MD5 c63205b0106ec69a289befbea0a0ac20
SHA1 fa0e1d8591ef653835ede5b5fb293b20f2d90014
SHA512 2dc7eaf9279e925b11825774c58401fdeca91dc7d9011b9132bb8a2dc091b5f543ed45ca104de118a94b1adb7a2e07e0069396fff7c2977646ade83bf47c81a3
SSDEEP 12288:y0Xz1CuwA5Rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rp0rps:y0X2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1136-15-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/1136-12-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/1136-16-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/1136-18-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/1136-19-0x00000000006F0000-0x0000000000705000-memory.dmp

Download

memory/2392-10-0x0000000000460000-0x0000000000560000-memory.dmp

Download

memory/2392-11-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/2392-17-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3916-4-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3916-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

Download

memory/3916-8-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/3916-9-0x00000000001E0000-0x00000000001F3000-memory.dmp

Download

memory/3916-1-0x0000000000690000-0x0000000000790000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads