tofsee | 8a93c65824b1533d359ad03057a4da0ee83dc4394f624e02cc28ecbc81228c61

General

Target

f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe
Size

14.9MB
MD5

f3cad536f7b02e9b4585980cb56c4f06
SHA1

ab02e0f1058250ff3d1ea6083b965721d8939915
SHA256

8a93c65824b1533d359ad03057a4da0ee83dc4394f624e02cc28ecbc81228c61
SHA512

d941192fb90f982e4891ec4d74cf4ca5979679ceaa7c3c55e3b23ebf62910c51c85799154a5e3d9da3f26f6396f01d36c3dbe76ccbd323532b842adbd90a3552
SSDEEP

6144:/pcqzKUTS5Yde/qyQK8ZtqTMIKC/eUPFwUnyaAjLo7pU6eD:vKUO54e/q60tmT7/xPFwVjs7G6

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

5028 netsh.exe

pid	process
5028	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\swrehtbq\ImagePath = "C:\\Windows\\SysWOW64\\swrehtbq\\xkkihivv.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2884 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

xkkihivv.exe

pid process

3520 xkkihivv.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xkkihivv.exe

description pid process target process

PID 3520 set thread context of 2884 3520 xkkihivv.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

412 sc.exe
2584 sc.exe
5100 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4608 1268 WerFault.exe f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe
4784 3520 WerFault.exe xkkihivv.exe

pid	process
2884	svchost.exe

pid	process
3520	xkkihivv.exe

description	pid	process	target process
PID 3520 set thread context of 2884	3520	xkkihivv.exe	svchost.exe

pid	process
412	sc.exe
2584	sc.exe
5100	sc.exe

pid	pid_target	process	target process
4608	1268	WerFault.exe	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe
4784	3520	WerFault.exe	xkkihivv.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exexkkihivv.exe

description	pid	process	target process
PID 1268 wrote to memory of 1172	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	cmd.exe
PID 1268 wrote to memory of 1172	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	cmd.exe
PID 1268 wrote to memory of 1172	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	cmd.exe
PID 1268 wrote to memory of 3088	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	cmd.exe
PID 1268 wrote to memory of 3088	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	cmd.exe
PID 1268 wrote to memory of 3088	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	cmd.exe
PID 1268 wrote to memory of 412	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 412	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 412	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 2584	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 2584	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 2584	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 5100	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 5100	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 5100	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	sc.exe
PID 1268 wrote to memory of 5028	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	netsh.exe
PID 1268 wrote to memory of 5028	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	netsh.exe
PID 1268 wrote to memory of 5028	1268	f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe	netsh.exe
PID 3520 wrote to memory of 2884	3520	xkkihivv.exe	svchost.exe
PID 3520 wrote to memory of 2884	3520	xkkihivv.exe	svchost.exe
PID 3520 wrote to memory of 2884	3520	xkkihivv.exe	svchost.exe
PID 3520 wrote to memory of 2884	3520	xkkihivv.exe	svchost.exe
PID 3520 wrote to memory of 2884	3520	xkkihivv.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\swrehtbq\
2⤵
PID:1172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xkkihivv.exe" C:\Windows\SysWOW64\swrehtbq\
2⤵
PID:3088

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create swrehtbq binPath= "C:\Windows\SysWOW64\swrehtbq\xkkihivv.exe /d\"C:\Users\Admin\AppData\Local\Temp\f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:412

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description swrehtbq "wifi internet conection"
2⤵
- Launches sc.exe
PID:2584

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start swrehtbq
2⤵
- Launches sc.exe
PID:5100

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1176
2⤵
- Program crash
PID:4608

C:\Windows\SysWOW64\swrehtbq\xkkihivv.exe
C:\Windows\SysWOW64\swrehtbq\xkkihivv.exe /d"C:\Users\Admin\AppData\Local\Temp\f3cad536f7b02e9b4585980cb56c4f06_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 512
2⤵
- Program crash
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1268 -ip 1268
1⤵
PID:528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3520 -ip 3520
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xkkihivv.exe
Filesize
11.2MB

MD5
04f0fce46430d161349f0908c07a68b1

SHA1
d2d18c75854b271bc16205fce5e0b37bf8a3a92f

SHA256
c85bff3ad01d2f47be1844b70da5045b3777c92ad7a91cf2d41ac4ac9763a5a0

SHA512
22622b9c28adb1196fd9728873de8a0bc26bc07c6e036b8942bd4139ebb2cf51ecdf0eb0bc7f6f5c8cc7ea512e62595a846734547803e9fe5c03589a333af0b8

Download Submit
memory/1268-1-0x0000000000520000-0x0000000000620000-memory.dmp

Filesize
1024KB

Download
memory/1268-2-0x00000000020C0000-0x00000000020D3000-memory.dmp

Filesize
76KB

Download
memory/1268-3-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1268-8-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1268-9-0x00000000020C0000-0x00000000020D3000-memory.dmp

Filesize
76KB

Download
memory/2884-11-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Filesize
84KB

Download
memory/2884-15-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Filesize
84KB

Download
memory/2884-16-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Filesize
84KB

Download
memory/2884-18-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Filesize
84KB

Download
memory/2884-19-0x0000000000CC0000-0x0000000000CD5000-memory.dmp

Filesize
84KB

Download
memory/3520-12-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/3520-10-0x0000000000670000-0x0000000000770000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads