tofsee | f17a88bf3b89dff62b431dacda445025c5c3764b9bc87bf584df2e4f274996b8

General

Target

f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
Size

10.7MB
MD5

f2c7b3dd677d36abe158ada055822669
SHA1

06f400ae6e2a2c0a1e8f64e702444a297f37d0f3
SHA256

f17a88bf3b89dff62b431dacda445025c5c3764b9bc87bf584df2e4f274996b8
SHA512

b59e41c6a44de1e9ca80189581a2d634df6d88b6442ba49d77dddf943043e81ce9a7cf92a5cc6a954d20d4414f9f237526e479718540a7cd16025091b07d3130
SSDEEP

98304:w11111111111111111111111111111111111111111111111111111111111111f:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2660 netsh.exe

pid	process
2660	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\semcsfig\ImagePath = "C:\\Windows\\SysWOW64\\semcsfig\\pgcjazdh.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1776 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

pgcjazdh.exe

pid process

812 pgcjazdh.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

pgcjazdh.exe

description pid process target process

PID 812 set thread context of 1776 812 pgcjazdh.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2924 sc.exe
4248 sc.exe
1864 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3684 2260 WerFault.exe f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
3956 812 WerFault.exe pgcjazdh.exe

pid	process
1776	svchost.exe

pid	process
812	pgcjazdh.exe

description	pid	process	target process
PID 812 set thread context of 1776	812	pgcjazdh.exe	svchost.exe

pid	process
2924	sc.exe
4248	sc.exe
1864	sc.exe

pid	pid_target	process	target process
3684	2260	WerFault.exe	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
3956	812	WerFault.exe	pgcjazdh.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exepgcjazdh.exe

description	pid	process	target process
PID 2260 wrote to memory of 2996	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	cmd.exe
PID 2260 wrote to memory of 2996	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	cmd.exe
PID 2260 wrote to memory of 2996	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	cmd.exe
PID 2260 wrote to memory of 972	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	cmd.exe
PID 2260 wrote to memory of 972	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	cmd.exe
PID 2260 wrote to memory of 972	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	cmd.exe
PID 2260 wrote to memory of 1864	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 1864	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 1864	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 2924	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 2924	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 2924	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 4248	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 4248	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 4248	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	sc.exe
PID 2260 wrote to memory of 2660	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	netsh.exe
PID 2260 wrote to memory of 2660	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	netsh.exe
PID 2260 wrote to memory of 2660	2260	f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe	netsh.exe
PID 812 wrote to memory of 1776	812	pgcjazdh.exe	svchost.exe
PID 812 wrote to memory of 1776	812	pgcjazdh.exe	svchost.exe
PID 812 wrote to memory of 1776	812	pgcjazdh.exe	svchost.exe
PID 812 wrote to memory of 1776	812	pgcjazdh.exe	svchost.exe
PID 812 wrote to memory of 1776	812	pgcjazdh.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\semcsfig\
2⤵
PID:2996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pgcjazdh.exe" C:\Windows\SysWOW64\semcsfig\
2⤵
PID:972

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create semcsfig binPath= "C:\Windows\SysWOW64\semcsfig\pgcjazdh.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1864

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description semcsfig "wifi internet conection"
2⤵
- Launches sc.exe
PID:2924

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start semcsfig
2⤵
- Launches sc.exe
PID:4248

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1036
2⤵
- Program crash
PID:3684

C:\Windows\SysWOW64\semcsfig\pgcjazdh.exe
C:\Windows\SysWOW64\semcsfig\pgcjazdh.exe /d"C:\Users\Admin\AppData\Local\Temp\f2c7b3dd677d36abe158ada055822669_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 812 -s 512
2⤵
- Program crash
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2260 -ip 2260
1⤵
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 812 -ip 812
1⤵
PID:3904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pgcjazdh.exe
Filesize
14.4MB

MD5
2086cec9bff4fb93d7ca86c8a20e1f35

SHA1
1431850296950ae489f710917cdf2a758e1bb502

SHA256
70dd1d5b72d202392af50d00b93f678c64fb18b8e22adf532c4ab2ef2371b522

SHA512
96c63bca61ab86688b97a60e7ef7d0f32dcd4a7542754ee7621add58f735c42337393680d68cfb0e0cae3737b2b8c5663cd55fe7abfa19fe04525965298c6f75

Download Submit
memory/812-10-0x00000000023B0000-0x00000000024B0000-memory.dmp

Filesize
1024KB

Download
memory/812-13-0x0000000000400000-0x0000000002234000-memory.dmp

Filesize
30.2MB

Download
memory/812-18-0x0000000000400000-0x0000000002234000-memory.dmp

Filesize
30.2MB

Download
memory/1776-11-0x0000000000830000-0x0000000000845000-memory.dmp

Filesize
84KB

Download
memory/1776-16-0x0000000000830000-0x0000000000845000-memory.dmp

Filesize
84KB

Download
memory/1776-17-0x0000000000830000-0x0000000000845000-memory.dmp

Filesize
84KB

Download
memory/1776-19-0x0000000000830000-0x0000000000845000-memory.dmp

Filesize
84KB

Download
memory/2260-4-0x0000000000400000-0x0000000002234000-memory.dmp

Filesize
30.2MB

Download
memory/2260-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/2260-7-0x0000000000400000-0x0000000002234000-memory.dmp

Filesize
30.2MB

Download
memory/2260-8-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/2260-1-0x0000000002250000-0x0000000002350000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads