tofsee | c09c6a7691b46bfea06316df79f17ed85a35610145b7e916417dfc557418bba2

General

Target

f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
Size

13.7MB
MD5

f315b58d3cfb7541cc071900a1e00671
SHA1

59e2447b1d9be5bdadbbd1b67da60631f6e123eb
SHA256

c09c6a7691b46bfea06316df79f17ed85a35610145b7e916417dfc557418bba2
SHA512

03d9bcec97ff66d779685f0854d1fce707a1c0c08d4b0f3e1298ea9f9e77cb0ed44efb1190f8029f9f3d27808d7c880f6dbfdccb0493dea981f10dda7fb12447
SSDEEP

49152:g1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllln:gA

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3912 netsh.exe

pid	process
3912	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lgteqbhk\ImagePath = "C:\\Windows\\SysWOW64\\lgteqbhk\\xjiwhrzt.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4108 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

xjiwhrzt.exe

pid process

2248 xjiwhrzt.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xjiwhrzt.exe

description pid process target process

PID 2248 set thread context of 4108 2248 xjiwhrzt.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4136 sc.exe
4784 sc.exe
4412 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2768 4720 WerFault.exe f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
916 2248 WerFault.exe xjiwhrzt.exe

pid	process
4108	svchost.exe

pid	process
2248	xjiwhrzt.exe

description	pid	process	target process
PID 2248 set thread context of 4108	2248	xjiwhrzt.exe	svchost.exe

pid	process
4136	sc.exe
4784	sc.exe
4412	sc.exe

pid	pid_target	process	target process
2768	4720	WerFault.exe	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
916	2248	WerFault.exe	xjiwhrzt.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exexjiwhrzt.exe

description	pid	process	target process
PID 4720 wrote to memory of 2324	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	cmd.exe
PID 4720 wrote to memory of 2324	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	cmd.exe
PID 4720 wrote to memory of 2324	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	cmd.exe
PID 4720 wrote to memory of 4608	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	cmd.exe
PID 4720 wrote to memory of 4608	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	cmd.exe
PID 4720 wrote to memory of 4608	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	cmd.exe
PID 4720 wrote to memory of 4136	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4136	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4136	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4784	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4784	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4784	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4412	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4412	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 4412	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	sc.exe
PID 4720 wrote to memory of 3912	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	netsh.exe
PID 4720 wrote to memory of 3912	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	netsh.exe
PID 4720 wrote to memory of 3912	4720	f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe	netsh.exe
PID 2248 wrote to memory of 4108	2248	xjiwhrzt.exe	svchost.exe
PID 2248 wrote to memory of 4108	2248	xjiwhrzt.exe	svchost.exe
PID 2248 wrote to memory of 4108	2248	xjiwhrzt.exe	svchost.exe
PID 2248 wrote to memory of 4108	2248	xjiwhrzt.exe	svchost.exe
PID 2248 wrote to memory of 4108	2248	xjiwhrzt.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lgteqbhk\
2⤵
PID:2324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xjiwhrzt.exe" C:\Windows\SysWOW64\lgteqbhk\
2⤵
PID:4608

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create lgteqbhk binPath= "C:\Windows\SysWOW64\lgteqbhk\xjiwhrzt.exe /d\"C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4136

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description lgteqbhk "wifi internet conection"
2⤵
- Launches sc.exe
PID:4784

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start lgteqbhk
2⤵
- Launches sc.exe
PID:4412

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 784
2⤵
- Program crash
PID:2768

C:\Windows\SysWOW64\lgteqbhk\xjiwhrzt.exe
C:\Windows\SysWOW64\lgteqbhk\xjiwhrzt.exe /d"C:\Users\Admin\AppData\Local\Temp\f315b58d3cfb7541cc071900a1e00671_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2248

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2248 -s 508
2⤵
- Program crash
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4720 -ip 4720
1⤵
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2248 -ip 2248
1⤵
PID:1576

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xjiwhrzt.exe
Filesize
13.1MB

MD5
c007205faa44af7d9e8a53ba80a0f65a

SHA1
54627b1dbc7250b279b45e94551545b292208d60

SHA256
84f72b287e9d66f441072032af4d54336f21499de289226f321a1aad7d5ee57a

SHA512
051f4b9c699d2f8d1711ced9043b1ef4314daad273b60ae07e58966637e1a63c6fe0f18ec26bf7529a91476f47b8bc87f8bad223250809b348a9598854718c99

Download Submit
memory/2248-10-0x0000000000C70000-0x0000000000D70000-memory.dmp

Filesize
1024KB

Download
memory/2248-12-0x0000000000400000-0x0000000000C20000-memory.dmp

Filesize
8.1MB

Download
memory/2248-17-0x0000000000400000-0x0000000000C20000-memory.dmp

Filesize
8.1MB

Download
memory/4108-11-0x0000000000D50000-0x0000000000D65000-memory.dmp

Filesize
84KB

Download
memory/4108-16-0x0000000000D50000-0x0000000000D65000-memory.dmp

Filesize
84KB

Download
memory/4108-18-0x0000000000D50000-0x0000000000D65000-memory.dmp

Filesize
84KB

Download
memory/4108-19-0x0000000000D50000-0x0000000000D65000-memory.dmp

Filesize
84KB

Download
memory/4720-4-0x0000000000400000-0x0000000000C20000-memory.dmp

Filesize
8.1MB

Download
memory/4720-2-0x0000000000DC0000-0x0000000000DD3000-memory.dmp

Filesize
76KB

Download
memory/4720-7-0x0000000000400000-0x0000000000C20000-memory.dmp

Filesize
8.1MB

Download
memory/4720-8-0x0000000000DC0000-0x0000000000DD3000-memory.dmp

Filesize
76KB

Download
memory/4720-1-0x0000000000E00000-0x0000000000F00000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads