tofsee | 3f487cd4fe611496acdd0cb193385e2bb233d535e99b5f6caadcf172150f38a5

General

Target

f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe
Size

14.5MB
MD5

f32bc79d3ad21de604fa37038da7e745
SHA1

51ce5b09338e62e7bd869cd2939c50ec011f1782
SHA256

3f487cd4fe611496acdd0cb193385e2bb233d535e99b5f6caadcf172150f38a5
SHA512

692cb21d4f9078953449114c7a3743fa201fdb391c89577a59c72d3e2bbc4f77174723a8f36f395cb508df82fbd24b989e11caa9c496f4ad85c9fc4931b45cdc
SSDEEP

196608:sb/////////////////////////////////////////////////////////////H:s

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2112 netsh.exe

pid	process
2112	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\adubduys\ImagePath = "C:\\Windows\\SysWOW64\\adubduys\\xecnsnbp.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2968 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

xecnsnbp.exe

pid process

3280 xecnsnbp.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xecnsnbp.exe

description pid process target process

PID 3280 set thread context of 2968 3280 xecnsnbp.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1976 sc.exe
3472 sc.exe
5020 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4636 4192 WerFault.exe f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe
4132 3280 WerFault.exe xecnsnbp.exe

pid	process
2968	svchost.exe

pid	process
3280	xecnsnbp.exe

description	pid	process	target process
PID 3280 set thread context of 2968	3280	xecnsnbp.exe	svchost.exe

pid	process
1976	sc.exe
3472	sc.exe
5020	sc.exe

pid	pid_target	process	target process
4636	4192	WerFault.exe	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe
4132	3280	WerFault.exe	xecnsnbp.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exexecnsnbp.exe

description	pid	process	target process
PID 4192 wrote to memory of 3452	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	cmd.exe
PID 4192 wrote to memory of 3452	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	cmd.exe
PID 4192 wrote to memory of 3452	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	cmd.exe
PID 4192 wrote to memory of 3636	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	cmd.exe
PID 4192 wrote to memory of 3636	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	cmd.exe
PID 4192 wrote to memory of 3636	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	cmd.exe
PID 4192 wrote to memory of 1976	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 1976	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 1976	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 3472	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 3472	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 3472	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 5020	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 5020	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 5020	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	sc.exe
PID 4192 wrote to memory of 2112	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	netsh.exe
PID 4192 wrote to memory of 2112	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	netsh.exe
PID 4192 wrote to memory of 2112	4192	f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe	netsh.exe
PID 3280 wrote to memory of 2968	3280	xecnsnbp.exe	svchost.exe
PID 3280 wrote to memory of 2968	3280	xecnsnbp.exe	svchost.exe
PID 3280 wrote to memory of 2968	3280	xecnsnbp.exe	svchost.exe
PID 3280 wrote to memory of 2968	3280	xecnsnbp.exe	svchost.exe
PID 3280 wrote to memory of 2968	3280	xecnsnbp.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\adubduys\
2⤵
PID:3452

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xecnsnbp.exe" C:\Windows\SysWOW64\adubduys\
2⤵
PID:3636

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create adubduys binPath= "C:\Windows\SysWOW64\adubduys\xecnsnbp.exe /d\"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1976

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description adubduys "wifi internet conection"
2⤵
- Launches sc.exe
PID:3472

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start adubduys
2⤵
- Launches sc.exe
PID:5020

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4192 -s 1036
2⤵
- Program crash
PID:4636

C:\Windows\SysWOW64\adubduys\xecnsnbp.exe
C:\Windows\SysWOW64\adubduys\xecnsnbp.exe /d"C:\Users\Admin\AppData\Local\Temp\f32bc79d3ad21de604fa37038da7e745_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3280

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:2968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 512
2⤵
- Program crash
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4192 -ip 4192
1⤵
PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3280 -ip 3280
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xecnsnbp.exe

Filesize
11.3MB

MD5
90a87ddb210cd64e39d00a809ec608cf

SHA1
a5a187728b068371679c9c628addbb31023908b2

SHA256
1332cafe6cf2a9d24a96ce35e959a17b151c9fd264170cc238c7c50dcada7c0e

SHA512
0090e2e10403c6b3aae619acc3c5a2fd356d7e35aec48e4fda9a368706dc8b4ddf48c1e705f47e0fe1a40cd3976c6207a493e5de8f797f61fa9886c0983a69ad

Download Submit
memory/2968-16-0x0000000000640000-0x0000000000655000-memory.dmp

Filesize
84KB

Download
memory/2968-11-0x0000000000640000-0x0000000000655000-memory.dmp

Filesize
84KB

Download
memory/2968-17-0x0000000000640000-0x0000000000655000-memory.dmp

Filesize
84KB

Download
memory/2968-19-0x0000000000640000-0x0000000000655000-memory.dmp

Filesize
84KB

Download
memory/3280-10-0x0000000000B90000-0x0000000000C90000-memory.dmp

Filesize
1024KB

Download
memory/3280-12-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/3280-18-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/4192-4-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/4192-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/4192-8-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/4192-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/4192-1-0x0000000000AF0000-0x0000000000BF0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads