tofsee | c02ce7fba728b8b8d459ff2a48fbbd0986cd474a16e339457b4d0e7ca538036d

General

Target

f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe
Size

12.9MB
MD5

f2908395b8a8846d7c3752da7ffcc9ad
SHA1

16c1bc4e5ac73414c889c3d49de2a67f3b88f517
SHA256

c02ce7fba728b8b8d459ff2a48fbbd0986cd474a16e339457b4d0e7ca538036d
SHA512

edb752d6c9e28dd06331882d407a0636c92cb97d38298610f8d3ea7fee8d94d7490498ceb4d5432e0ca06f90b9de1d0c592186bd1abce277d4904f18d22f8476
SSDEEP

24576:perU5sWbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbr:psW

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\szzhdcxi = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2732 netsh.exe

pid	process
2732	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\szzhdcxi\ImagePath = "C:\\Windows\\SysWOW64\\szzhdcxi\\tckibdgg.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2448 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

tckibdgg.exe

pid process

2464 tckibdgg.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

tckibdgg.exe

description pid process target process

PID 2464 set thread context of 2448 2464 tckibdgg.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2660 sc.exe
1716 sc.exe
2720 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2448	svchost.exe

pid	process
2464	tckibdgg.exe

description	pid	process	target process
PID 2464 set thread context of 2448	2464	tckibdgg.exe	svchost.exe

pid	process
2660	sc.exe
1716	sc.exe
2720	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exetckibdgg.exe

description	pid	process	target process
PID 2372 wrote to memory of 2928	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2928	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2928	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2928	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2584	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2584	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2584	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2584	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	cmd.exe
PID 2372 wrote to memory of 2660	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2660	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2660	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2660	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 1716	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 1716	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 1716	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 1716	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2720	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2720	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2720	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2720	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	sc.exe
PID 2372 wrote to memory of 2732	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	netsh.exe
PID 2372 wrote to memory of 2732	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	netsh.exe
PID 2372 wrote to memory of 2732	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	netsh.exe
PID 2372 wrote to memory of 2732	2372	f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe	netsh.exe
PID 2464 wrote to memory of 2448	2464	tckibdgg.exe	svchost.exe
PID 2464 wrote to memory of 2448	2464	tckibdgg.exe	svchost.exe
PID 2464 wrote to memory of 2448	2464	tckibdgg.exe	svchost.exe
PID 2464 wrote to memory of 2448	2464	tckibdgg.exe	svchost.exe
PID 2464 wrote to memory of 2448	2464	tckibdgg.exe	svchost.exe
PID 2464 wrote to memory of 2448	2464	tckibdgg.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\szzhdcxi\
2⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tckibdgg.exe" C:\Windows\SysWOW64\szzhdcxi\
2⤵
PID:2584

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create szzhdcxi binPath= "C:\Windows\SysWOW64\szzhdcxi\tckibdgg.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2660

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description szzhdcxi "wifi internet conection"
2⤵
- Launches sc.exe
PID:1716

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start szzhdcxi
2⤵
- Launches sc.exe
PID:2720

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2732

C:\Windows\SysWOW64\szzhdcxi\tckibdgg.exe
C:\Windows\SysWOW64\szzhdcxi\tckibdgg.exe /d"C:\Users\Admin\AppData\Local\Temp\f2908395b8a8846d7c3752da7ffcc9ad_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2448

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tckibdgg.exe
Filesize
14.8MB

MD5
89af52b55abc33de7fc2a1df74d2bfb0

SHA1
75785319dfd24572b317e1c3e3b359215f168d87

SHA256
d226b53b7b6e340d68ac69f4f8f045892c23c9f0cc6dfd6969f29ee704a35ba7

SHA512
2f9c48224a7f9380c8ad7daa5b6d454b1284796263c743a4d6703bdf424303fdb95b1d427780dd897d04686c9b2e21e5b1d1c927d9c6e1f1f74e0045748007e2

Download Submit
memory/2372-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2372-3-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2372-4-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2372-6-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2448-14-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2448-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2448-11-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2448-18-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2448-19-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2448-20-0x0000000000100000-0x0000000000115000-memory.dmp

Filesize
84KB

Download
memory/2464-10-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2464-16-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2464-9-0x0000000000580000-0x0000000000680000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads