tofsee | 084d26ac03fadeb25260cb626efda571fc92bca3528d8dae61e30be71d126fae

General

Target

f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe
Size

13.8MB
MD5

f3147553bec69b2a2b4001b906c9c8c5
SHA1

06c668815a1c3134336042e822c8c8a65f3f3434
SHA256

084d26ac03fadeb25260cb626efda571fc92bca3528d8dae61e30be71d126fae
SHA512

6e2d33055bb88f1ee81ba1c9d3f567c2ee521562997f4ba291a626a9a13a587de3c746161e4a138f5e63f0f066454685066de465e6da53c1d1322566aed7023f
SSDEEP

49152:ARBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3388 netsh.exe

pid	process
3388	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pjyfyfto\ImagePath = "C:\\Windows\\SysWOW64\\pjyfyfto\\ifxokbxv.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2260 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

ifxokbxv.exe

pid process

1692 ifxokbxv.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ifxokbxv.exe

description pid process target process

PID 1692 set thread context of 2260 1692 ifxokbxv.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1340 sc.exe
1512 sc.exe
3640 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1460 2972 WerFault.exe f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe
4412 1692 WerFault.exe ifxokbxv.exe

pid	process
2260	svchost.exe

pid	process
1692	ifxokbxv.exe

description	pid	process	target process
PID 1692 set thread context of 2260	1692	ifxokbxv.exe	svchost.exe

pid	process
1340	sc.exe
1512	sc.exe
3640	sc.exe

pid	pid_target	process	target process
1460	2972	WerFault.exe	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe
4412	1692	WerFault.exe	ifxokbxv.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exeifxokbxv.exe

description	pid	process	target process
PID 2972 wrote to memory of 4416	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	cmd.exe
PID 2972 wrote to memory of 4416	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	cmd.exe
PID 2972 wrote to memory of 4416	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	cmd.exe
PID 2972 wrote to memory of 1144	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	cmd.exe
PID 2972 wrote to memory of 1144	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	cmd.exe
PID 2972 wrote to memory of 1144	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	cmd.exe
PID 2972 wrote to memory of 3640	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 3640	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 3640	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 1340	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 1340	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 1340	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 1512	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 1512	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 1512	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	sc.exe
PID 2972 wrote to memory of 3388	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	netsh.exe
PID 2972 wrote to memory of 3388	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	netsh.exe
PID 2972 wrote to memory of 3388	2972	f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe	netsh.exe
PID 1692 wrote to memory of 2260	1692	ifxokbxv.exe	svchost.exe
PID 1692 wrote to memory of 2260	1692	ifxokbxv.exe	svchost.exe
PID 1692 wrote to memory of 2260	1692	ifxokbxv.exe	svchost.exe
PID 1692 wrote to memory of 2260	1692	ifxokbxv.exe	svchost.exe
PID 1692 wrote to memory of 2260	1692	ifxokbxv.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pjyfyfto\
2⤵
PID:4416

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ifxokbxv.exe" C:\Windows\SysWOW64\pjyfyfto\
2⤵
PID:1144

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create pjyfyfto binPath= "C:\Windows\SysWOW64\pjyfyfto\ifxokbxv.exe /d\"C:\Users\Admin\AppData\Local\Temp\f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:3640

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description pjyfyfto "wifi internet conection"
2⤵
- Launches sc.exe
PID:1340

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start pjyfyfto
2⤵
- Launches sc.exe
PID:1512

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 1040
2⤵
- Program crash
PID:1460

C:\Windows\SysWOW64\pjyfyfto\ifxokbxv.exe
C:\Windows\SysWOW64\pjyfyfto\ifxokbxv.exe /d"C:\Users\Admin\AppData\Local\Temp\f3147553bec69b2a2b4001b906c9c8c5_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 512
2⤵
- Program crash
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2972 -ip 2972
1⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1692 -ip 1692
1⤵
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ifxokbxv.exe
Filesize
11.8MB

MD5
3eb2478a21d1e96ca1d6cb47930dade3

SHA1
37191dc922aa727a238b13529b36713ac446a7b0

SHA256
4c48ca2eb12fed268196943d26049987f4f17a1a8f5d0c27f0d5201987452c1a

SHA512
02de0c7da721cc4f95e81e29278eeea36f6a9aea0712f0c64862ce792981c409182b0dea643297ad1f7c1e107689252f6a84151f813d67a9f3edd51132b74d8d

Download Submit
memory/1692-10-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

Filesize
1024KB

Download
memory/1692-12-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/1692-17-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2260-11-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2260-15-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2260-16-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2260-18-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2260-19-0x0000000000500000-0x0000000000515000-memory.dmp

Filesize
84KB

Download
memory/2972-4-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2972-2-0x0000000000EB0000-0x0000000000EC3000-memory.dmp

Filesize
76KB

Download
memory/2972-7-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/2972-8-0x0000000000EB0000-0x0000000000EC3000-memory.dmp

Filesize
76KB

Download
memory/2972-1-0x0000000000F30000-0x0000000001030000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads