tofsee | 3310aa6e6f635f3e3610e897d48323758555304bd7bfa2c77473a2119cef2f86

General

Target

f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe
Size

14.3MB
MD5

f41244b3df60d807930f4c7b3096d0a7
SHA1

d0cbe5f91f407229da11bcd1cf3950544310987a
SHA256

3310aa6e6f635f3e3610e897d48323758555304bd7bfa2c77473a2119cef2f86
SHA512

31238ef37c39bedd4582ed9eb72aa6df2fad87ddbdae1f14803d0c58ab4b9de1c96c9140cdfc4d9ff11d06bab43abb2d9fd59bd798edb7abfae6a3d2b473531a
SSDEEP

49152:xM+SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSn:x

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2960 netsh.exe

pid	process
2960	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\pjboveil\ImagePath = "C:\\Windows\\SysWOW64\\pjboveil\\gpjogfaw.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2752 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

gpjogfaw.exe

pid process

2532 gpjogfaw.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

gpjogfaw.exe

description pid process target process

PID 2532 set thread context of 2752 2532 gpjogfaw.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1900 sc.exe
4688 sc.exe
2728 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4036 3136 WerFault.exe f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe
3356 2532 WerFault.exe gpjogfaw.exe

pid	process
2752	svchost.exe

pid	process
2532	gpjogfaw.exe

description	pid	process	target process
PID 2532 set thread context of 2752	2532	gpjogfaw.exe	svchost.exe

pid	process
1900	sc.exe
4688	sc.exe
2728	sc.exe

pid	pid_target	process	target process
4036	3136	WerFault.exe	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe
3356	2532	WerFault.exe	gpjogfaw.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exegpjogfaw.exe

description	pid	process	target process
PID 3136 wrote to memory of 752	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	cmd.exe
PID 3136 wrote to memory of 752	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	cmd.exe
PID 3136 wrote to memory of 752	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	cmd.exe
PID 3136 wrote to memory of 1460	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	cmd.exe
PID 3136 wrote to memory of 1460	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	cmd.exe
PID 3136 wrote to memory of 1460	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	cmd.exe
PID 3136 wrote to memory of 4688	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 4688	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 4688	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 2728	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 2728	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 2728	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 1900	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 1900	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 1900	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	sc.exe
PID 3136 wrote to memory of 2960	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	netsh.exe
PID 3136 wrote to memory of 2960	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	netsh.exe
PID 3136 wrote to memory of 2960	3136	f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe	netsh.exe
PID 2532 wrote to memory of 2752	2532	gpjogfaw.exe	svchost.exe
PID 2532 wrote to memory of 2752	2532	gpjogfaw.exe	svchost.exe
PID 2532 wrote to memory of 2752	2532	gpjogfaw.exe	svchost.exe
PID 2532 wrote to memory of 2752	2532	gpjogfaw.exe	svchost.exe
PID 2532 wrote to memory of 2752	2532	gpjogfaw.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\pjboveil\
2⤵
PID:752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gpjogfaw.exe" C:\Windows\SysWOW64\pjboveil\
2⤵
PID:1460

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create pjboveil binPath= "C:\Windows\SysWOW64\pjboveil\gpjogfaw.exe /d\"C:\Users\Admin\AppData\Local\Temp\f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4688

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description pjboveil "wifi internet conection"
2⤵
- Launches sc.exe
PID:2728

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start pjboveil
2⤵
- Launches sc.exe
PID:1900

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 1044
2⤵
- Program crash
PID:4036

C:\Windows\SysWOW64\pjboveil\gpjogfaw.exe
C:\Windows\SysWOW64\pjboveil\gpjogfaw.exe /d"C:\Users\Admin\AppData\Local\Temp\f41244b3df60d807930f4c7b3096d0a7_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 512
2⤵
- Program crash
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3136 -ip 3136
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2532 -ip 2532
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gpjogfaw.exe

Filesize
13.2MB

MD5
3eb826c56afd720532fe1a5aca415d1d

SHA1
dc50971a33cce510d331ce7990b18fb3197635dd

SHA256
f858a382cc50286aaae16e7474212fb25770af4168eb197a8d4f8d5e9e755438

SHA512
6dda1143953f039024fea1812344e794a80ba557e61af62fce38dfcaf61b99e03d792b9ffdb57f2b64e117daaceee6121c5884cb47686e0be62f8e240d657480

Download Submit
memory/2532-10-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download
memory/2532-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2532-18-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2752-12-0x0000000000C40000-0x0000000000C55000-memory.dmp

Filesize
84KB

Download
memory/2752-15-0x0000000000C40000-0x0000000000C55000-memory.dmp

Filesize
84KB

Download
memory/2752-16-0x0000000000C40000-0x0000000000C55000-memory.dmp

Filesize
84KB

Download
memory/2752-17-0x0000000000C40000-0x0000000000C55000-memory.dmp

Filesize
84KB

Download
memory/2752-19-0x0000000000C40000-0x0000000000C55000-memory.dmp

Filesize
84KB

Download
memory/3136-3-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3136-2-0x0000000000600000-0x0000000000613000-memory.dmp

Filesize
76KB

Download
memory/3136-7-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3136-8-0x0000000000600000-0x0000000000613000-memory.dmp

Filesize
76KB

Download
memory/3136-1-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads