tofsee | c89d2e5ffe20c5e936a9df89dbe29d684442bdb0ec0401fdf7e34e25963866fc

General

Target

f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
Size

14.8MB
MD5

f3015e7fa8a419f7f1110881d4a15abf
SHA1

2bb0e90e81ce18596a98bb7f72eaabf63e1147f1
SHA256

c89d2e5ffe20c5e936a9df89dbe29d684442bdb0ec0401fdf7e34e25963866fc
SHA512

ed53c70614f15716e277d984d5d3131af53c407befcd72ad7398b06da3f18af7fd95d58db5eeb9c0cd16a3dc6f8334576c1236f9881738fd0785b9d3337bd06d
SSDEEP

49152:Tuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1012 netsh.exe

pid	process
1012	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\owtyvebl\ImagePath = "C:\\Windows\\SysWOW64\\owtyvebl\\xkbkcprl.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4328 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

xkbkcprl.exe

pid process

3344 xkbkcprl.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xkbkcprl.exe

description pid process target process

PID 3344 set thread context of 4328 3344 xkbkcprl.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4200 sc.exe
4108 sc.exe
2980 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1620 2624 WerFault.exe f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
4232 3344 WerFault.exe xkbkcprl.exe

pid	process
4328	svchost.exe

pid	process
3344	xkbkcprl.exe

description	pid	process	target process
PID 3344 set thread context of 4328	3344	xkbkcprl.exe	svchost.exe

pid	process
4200	sc.exe
4108	sc.exe
2980	sc.exe

pid	pid_target	process	target process
1620	2624	WerFault.exe	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
4232	3344	WerFault.exe	xkbkcprl.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exexkbkcprl.exe

description	pid	process	target process
PID 2624 wrote to memory of 4724	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	cmd.exe
PID 2624 wrote to memory of 4724	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	cmd.exe
PID 2624 wrote to memory of 4724	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	cmd.exe
PID 2624 wrote to memory of 1484	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	cmd.exe
PID 2624 wrote to memory of 1484	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	cmd.exe
PID 2624 wrote to memory of 1484	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	cmd.exe
PID 2624 wrote to memory of 4200	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 4200	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 4200	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 4108	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 4108	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 4108	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 2980	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 2980	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 2980	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	sc.exe
PID 2624 wrote to memory of 1012	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	netsh.exe
PID 2624 wrote to memory of 1012	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	netsh.exe
PID 2624 wrote to memory of 1012	2624	f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe	netsh.exe
PID 3344 wrote to memory of 4328	3344	xkbkcprl.exe	svchost.exe
PID 3344 wrote to memory of 4328	3344	xkbkcprl.exe	svchost.exe
PID 3344 wrote to memory of 4328	3344	xkbkcprl.exe	svchost.exe
PID 3344 wrote to memory of 4328	3344	xkbkcprl.exe	svchost.exe
PID 3344 wrote to memory of 4328	3344	xkbkcprl.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\owtyvebl\
2⤵
PID:4724

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xkbkcprl.exe" C:\Windows\SysWOW64\owtyvebl\
2⤵
PID:1484

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create owtyvebl binPath= "C:\Windows\SysWOW64\owtyvebl\xkbkcprl.exe /d\"C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4200

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description owtyvebl "wifi internet conection"
2⤵
- Launches sc.exe
PID:4108

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start owtyvebl
2⤵
- Launches sc.exe
PID:2980

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 888
2⤵
- Program crash
PID:1620

C:\Windows\SysWOW64\owtyvebl\xkbkcprl.exe
C:\Windows\SysWOW64\owtyvebl\xkbkcprl.exe /d"C:\Users\Admin\AppData\Local\Temp\f3015e7fa8a419f7f1110881d4a15abf_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3344

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3344 -s 516
2⤵
- Program crash
PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2624 -ip 2624
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3344 -ip 3344
1⤵
PID:3980

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xkbkcprl.exe
Filesize
13.0MB

MD5
6b9cce3f1a6c0796a7facb59ab3eee8d

SHA1
8d623a773e1fb4014bfef487093f2ce0d1a35ea4

SHA256
29a0597affa64c55121f86c7fa43744c1f86bdb73b042de0fca61246a39a9910

SHA512
def39af4bbad7f0cb40ab0893b33efe6f5714c33456ca593318690f697c0775607a2d5e23330b8ae48953f57aca50da7af4d54ed67b679d462adbe1dcf6104c5

Download Submit
memory/2624-2-0x00000000049B0000-0x00000000049C3000-memory.dmp

Filesize
76KB

Download
memory/2624-4-0x0000000000400000-0x0000000002C68000-memory.dmp

Filesize
40.4MB

Download
memory/2624-8-0x0000000000400000-0x0000000002C68000-memory.dmp

Filesize
40.4MB

Download
memory/2624-9-0x00000000049B0000-0x00000000049C3000-memory.dmp

Filesize
76KB

Download
memory/2624-1-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

Filesize
1024KB

Download
memory/3344-17-0x0000000000400000-0x0000000002C68000-memory.dmp

Filesize
40.4MB

Download
memory/3344-12-0x0000000003010000-0x0000000003110000-memory.dmp

Filesize
1024KB

Download
memory/3344-19-0x0000000000400000-0x0000000002C68000-memory.dmp

Filesize
40.4MB

Download
memory/4328-10-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/4328-16-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/4328-18-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/4328-14-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/4328-20-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads