tofsee | 90866ff59fb98f3e2e5e3cfc75a4ca0acb389f3ef9d64814f03b222ea295d081

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe
Size 11.5MB
Sample240405-jtsqeafd56
SHA256 90866ff59fb98f3e2e5e3cfc75a4ca0acb389f3ef9d64814f03b222ea295d081
MD5 cdf948f19635662f3f7fcb8a1dbc1d74
SHA1 4aaf199cd2e84a70a6c33d1241bbe137f64eb75d
SHA512 d2f6ab9c958f0a35d7201eec6219aa321a818767e81e94c03c98ac5c4963f158b49ae095967b52ec7e1ae68563474d61f8baaef8b229cbd27f4350c9348f903a
SSDEEP 49152:ItCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCq:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

quadoil.ru
lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4848	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\yqmhplzx\ImagePath = "C:\\Windows\\SysWOW64\\yqmhplzx\\lyhefkwj.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2820	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4384	lyhefkwj.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4384 set thread context of 2820	4384	lyhefkwj.exe	108

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3412	sc.exe
4800	sc.exe
1712	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
744	4796	WerFault.exe	83
1768	4384	WerFault.exe	101

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3352	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	89
PID 4796 wrote to memory of 3352	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	89
PID 4796 wrote to memory of 3352	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	89
PID 4796 wrote to memory of 208	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	92
PID 4796 wrote to memory of 208	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	92
PID 4796 wrote to memory of 208	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	92
PID 4796 wrote to memory of 1712	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	95
PID 4796 wrote to memory of 1712	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	95
PID 4796 wrote to memory of 1712	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	95
PID 4796 wrote to memory of 3412	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	97
PID 4796 wrote to memory of 3412	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	97
PID 4796 wrote to memory of 3412	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	97
PID 4796 wrote to memory of 4800	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	99
PID 4796 wrote to memory of 4800	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	99
PID 4796 wrote to memory of 4800	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	99
PID 4796 wrote to memory of 4848	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	102
PID 4796 wrote to memory of 4848	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	102
PID 4796 wrote to memory of 4848	4796	cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe	102
PID 4384 wrote to memory of 2820	4384	lyhefkwj.exe	108
PID 4384 wrote to memory of 2820	4384	lyhefkwj.exe	108
PID 4384 wrote to memory of 2820	4384	lyhefkwj.exe	108
PID 4384 wrote to memory of 2820	4384	lyhefkwj.exe	108
PID 4384 wrote to memory of 2820	4384	lyhefkwj.exe	108

C:\Users\Admin\AppData\Local\Temp\cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yqmhplzx\
  2⤵
  PID:3352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lyhefkwj.exe" C:\Windows\SysWOW64\yqmhplzx\
  2⤵
  PID:208
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create yqmhplzx binPath= "C:\Windows\SysWOW64\yqmhplzx\lyhefkwj.exe /d\"C:\Users\Admin\AppData\Local\Temp\cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1712
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description yqmhplzx "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3412
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start yqmhplzx
  2⤵
  - Launches sc.exe
  PID:4800
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:4848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1264
  2⤵
  - Program crash
  PID:744

C:\Windows\SysWOW64\yqmhplzx\lyhefkwj.exe
C:\Windows\SysWOW64\yqmhplzx\lyhefkwj.exe /d"C:\Users\Admin\AppData\Local\Temp\cdf948f19635662f3f7fcb8a1dbc1d74_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:2820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 560
  2⤵
  - Program crash
  PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4796 -ip 4796
1⤵
PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4384 -ip 4384
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lyhefkwj.exe

Path C:\Users\Admin\AppData\Local\Temp\lyhefkwj.exe
Size 11.7MB
SHA256 26c7753decea6ea0337c710c6c6fc092d085bf0468915990dd1e64667a87a3eb
MD5 9753980c1ac99bc4ab8c300d87366115
SHA1 d2ffdc861fffd8438ff79eb29986942e33b31572
SHA512 89bd69b9e8775b0510c82438be3cf5016dc7d7e9823c20ab7d88a43357496755492b8577ff96d3d62908765d8e64d9700da6ee254c1a0807304cb927b753c74a
SSDEEP 49152:/tCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCtCS:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2820-16-0x0000000000670000-0x0000000000685000-memory.dmp

Download

memory/2820-11-0x0000000000670000-0x0000000000685000-memory.dmp

Download

memory/2820-17-0x0000000000670000-0x0000000000685000-memory.dmp

Download

memory/2820-19-0x0000000000670000-0x0000000000685000-memory.dmp

Download

memory/4384-10-0x0000000001790000-0x0000000001890000-memory.dmp

Download

memory/4384-13-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/4384-18-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/4796-4-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/4796-2-0x0000000003420000-0x0000000003433000-memory.dmp

Download

memory/4796-8-0x0000000000400000-0x00000000016BC000-memory.dmp

Download

memory/4796-9-0x0000000003420000-0x0000000003433000-memory.dmp

Download

memory/4796-1-0x0000000001830000-0x0000000001930000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads