tofsee | a7b7595a90d115497ba26e7ac70d71a499a0c0116a1f13f671eccbd8af89de8e

General

Target

f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe
Size

14.2MB
MD5

f3e4b3f22f1f557ad9aed99b8b9be8aa
SHA1

9c41524315acdf2d2e6c38959ae3f2b4337aa899
SHA256

a7b7595a90d115497ba26e7ac70d71a499a0c0116a1f13f671eccbd8af89de8e
SHA512

b8e72b697c42403f2bb94bf6fe003b6267de27f59f897749e63009b8b2c5275c1952237deff4039f09a8ffc494c45f15d77f3dc7b58cf2bf1be81fcd5e177037
SSDEEP

12288:zl5qOcvT9o+egMU+HoWfprc0sssssssssssssssssssssssssssssssssssssssb:1cvT9ofeqrc

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2124 netsh.exe

pid	process
2124	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ssdpmgvj\ImagePath = "C:\\Windows\\SysWOW64\\ssdpmgvj\\cczuxofx.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-553605503-2331009851-2137262461-1000\Control Panel\International\Geo\Nation	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

3932 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

cczuxofx.exe

pid process

4428 cczuxofx.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cczuxofx.exe

description pid process target process

PID 4428 set thread context of 3932 4428 cczuxofx.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4056 sc.exe
3728 sc.exe
3408 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5052 1736 WerFault.exe f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe
796 4428 WerFault.exe cczuxofx.exe

pid	process
3932	svchost.exe

pid	process
4428	cczuxofx.exe

description	pid	process	target process
PID 4428 set thread context of 3932	4428	cczuxofx.exe	svchost.exe

pid	process
4056	sc.exe
3728	sc.exe
3408	sc.exe

pid	pid_target	process	target process
5052	1736	WerFault.exe	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe
796	4428	WerFault.exe	cczuxofx.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.execczuxofx.exe

description	pid	process	target process
PID 1736 wrote to memory of 440	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	cmd.exe
PID 1736 wrote to memory of 440	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	cmd.exe
PID 1736 wrote to memory of 440	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	cmd.exe
PID 1736 wrote to memory of 3280	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	cmd.exe
PID 1736 wrote to memory of 3280	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	cmd.exe
PID 1736 wrote to memory of 3280	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	cmd.exe
PID 1736 wrote to memory of 4056	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 4056	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 4056	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 3728	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 3728	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 3728	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 3408	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 3408	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 3408	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	sc.exe
PID 1736 wrote to memory of 2124	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	netsh.exe
PID 1736 wrote to memory of 2124	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	netsh.exe
PID 1736 wrote to memory of 2124	1736	f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe	netsh.exe
PID 4428 wrote to memory of 3932	4428	cczuxofx.exe	svchost.exe
PID 4428 wrote to memory of 3932	4428	cczuxofx.exe	svchost.exe
PID 4428 wrote to memory of 3932	4428	cczuxofx.exe	svchost.exe
PID 4428 wrote to memory of 3932	4428	cczuxofx.exe	svchost.exe
PID 4428 wrote to memory of 3932	4428	cczuxofx.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ssdpmgvj\
2⤵
PID:440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cczuxofx.exe" C:\Windows\SysWOW64\ssdpmgvj\
2⤵
PID:3280

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create ssdpmgvj binPath= "C:\Windows\SysWOW64\ssdpmgvj\cczuxofx.exe /d\"C:\Users\Admin\AppData\Local\Temp\f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4056

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description ssdpmgvj "wifi internet conection"
2⤵
- Launches sc.exe
PID:3728

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ssdpmgvj
2⤵
- Launches sc.exe
PID:3408

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1244
2⤵
- Program crash
PID:5052

C:\Windows\SysWOW64\ssdpmgvj\cczuxofx.exe
C:\Windows\SysWOW64\ssdpmgvj\cczuxofx.exe /d"C:\Users\Admin\AppData\Local\Temp\f3e4b3f22f1f557ad9aed99b8b9be8aa_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 508
2⤵
- Program crash
PID:796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1736 -ip 1736
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4428 -ip 4428
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cczuxofx.exe
Filesize
12.5MB

MD5
4a83c0f236a924dbe26ce9558ef05f0d

SHA1
dc66846a3d20ac796b7732a4a4a99deee061fbe1

SHA256
52ada2d6ccdfa53164f2dcaff4449afad75a98e8211afb1e6a9a23bb489b934d

SHA512
05142ce6c9cd64d4fd3163661967a012b340c8cc63af7bdf374bb9cde538f1df743cd721e49369648206f9ce009cd1c65ce7222d9880c5d8a5fc6b60a191d0bf

Download Submit
memory/1736-1-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/1736-2-0x00000000021B0000-0x00000000021C3000-memory.dmp

Filesize
76KB

Download
memory/1736-3-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1736-8-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1736-9-0x00000000021B0000-0x00000000021C3000-memory.dmp

Filesize
76KB

Download
memory/3932-15-0x0000000000610000-0x0000000000625000-memory.dmp

Filesize
84KB

Download
memory/3932-12-0x0000000000610000-0x0000000000625000-memory.dmp

Filesize
84KB

Download
memory/3932-16-0x0000000000610000-0x0000000000625000-memory.dmp

Filesize
84KB

Download
memory/3932-18-0x0000000000610000-0x0000000000625000-memory.dmp

Filesize
84KB

Download
memory/3932-19-0x0000000000610000-0x0000000000625000-memory.dmp

Filesize
84KB

Download
memory/4428-11-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/4428-10-0x0000000000720000-0x0000000000820000-memory.dmp

Filesize
1024KB

Download
memory/4428-17-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads