tofsee | 8a19788e6391d24385ece1dc77bb1a3f381bfd951faa17ce3925592842d19986

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f284271435132b9487ddf8dd41992578_JaffaCakes118.exe
Size 14.2MB
Sample240416-dbjf5aff38
SHA256 8a19788e6391d24385ece1dc77bb1a3f381bfd951faa17ce3925592842d19986
MD5 f284271435132b9487ddf8dd41992578
SHA1 26ec52a5e08c3370a92e47b5f43a12057cbe8616
SHA512 4027ec19d3371d2707855d1e709a48ac96e9c09251a57de035c5e2d0b10cb6ecdeddae9e6c235c524022ff305b794340815fa2ad40a7d6cf287f2304942a0687
SSDEEP 196608:0zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

43.231.4.6
lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2656	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vsprttnt\ImagePath = "C:\\Windows\\SysWOW64\\vsprttnt\\agrcujdp.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
976	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1952	agrcujdp.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 976	1952	agrcujdp.exe	103

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1508	sc.exe
4924	sc.exe
4856	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1900	4992	WerFault.exe	81
3348	1952	WerFault.exe	98

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3860	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	88
PID 4992 wrote to memory of 3860	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	88
PID 4992 wrote to memory of 3860	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	88
PID 4992 wrote to memory of 3540	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	90
PID 4992 wrote to memory of 3540	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	90
PID 4992 wrote to memory of 3540	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	90
PID 4992 wrote to memory of 1508	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	92
PID 4992 wrote to memory of 1508	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	92
PID 4992 wrote to memory of 1508	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	92
PID 4992 wrote to memory of 4924	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	94
PID 4992 wrote to memory of 4924	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	94
PID 4992 wrote to memory of 4924	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	94
PID 4992 wrote to memory of 4856	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	96
PID 4992 wrote to memory of 4856	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	96
PID 4992 wrote to memory of 4856	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	96
PID 4992 wrote to memory of 2656	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	99
PID 4992 wrote to memory of 2656	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	99
PID 4992 wrote to memory of 2656	4992	f284271435132b9487ddf8dd41992578_JaffaCakes118.exe	99
PID 1952 wrote to memory of 976	1952	agrcujdp.exe	103
PID 1952 wrote to memory of 976	1952	agrcujdp.exe	103
PID 1952 wrote to memory of 976	1952	agrcujdp.exe	103
PID 1952 wrote to memory of 976	1952	agrcujdp.exe	103
PID 1952 wrote to memory of 976	1952	agrcujdp.exe	103

C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vsprttnt\
  2⤵
  PID:3860
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\agrcujdp.exe" C:\Windows\SysWOW64\vsprttnt\
  2⤵
  PID:3540
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create vsprttnt binPath= "C:\Windows\SysWOW64\vsprttnt\agrcujdp.exe /d\"C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1508
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description vsprttnt "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:4924
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start vsprttnt
  2⤵
  - Launches sc.exe
  PID:4856
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 1400
  2⤵
  - Program crash
  PID:1900

C:\Windows\SysWOW64\vsprttnt\agrcujdp.exe
C:\Windows\SysWOW64\vsprttnt\agrcujdp.exe /d"C:\Users\Admin\AppData\Local\Temp\f284271435132b9487ddf8dd41992578_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  PID:976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 520
  2⤵
  - Program crash
  PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4992 -ip 4992
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1952 -ip 1952
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

agrcujdp.exe

Path C:\Users\Admin\AppData\Local\Temp\agrcujdp.exe
Size 13.5MB
SHA256 dbedfb2517d288d7f75ce69269e14a216885e86c4b3edf76288a9c23d45a1a0b
MD5 b63e43c00bfa322a2382ffc8be38c138
SHA1 62d08102955f80b2f5c626e11d56fe3ef4e2a94c
SHA512 68053ef8c0a57f2cbad8a65a61a3f3ffda641c79d0b8e476b933d23dd785362a978f1172ce62d2f05e41d362a2465b15c1e7e19463edd83dc1274ccc9e368d88
SSDEEP 196608:zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzL:
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/976-15-0x0000000000CA0000-0x0000000000CB5000-memory.dmp

Download

memory/976-12-0x0000000000CA0000-0x0000000000CB5000-memory.dmp

Download

memory/976-17-0x0000000000CA0000-0x0000000000CB5000-memory.dmp

Download

memory/976-18-0x0000000000CA0000-0x0000000000CB5000-memory.dmp

Download

memory/1952-10-0x0000000000B50000-0x0000000000C50000-memory.dmp

Download

memory/1952-11-0x0000000000400000-0x00000000008EB000-memory.dmp

Download

memory/1952-16-0x0000000000400000-0x00000000008EB000-memory.dmp

Download

memory/4992-4-0x0000000000400000-0x00000000008EB000-memory.dmp

Download

memory/4992-2-0x0000000000B50000-0x0000000000B63000-memory.dmp

Download

memory/4992-7-0x0000000000400000-0x00000000008EB000-memory.dmp

Download

memory/4992-8-0x0000000000B50000-0x0000000000B63000-memory.dmp

Download

memory/4992-1-0x0000000000C40000-0x0000000000D40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads