tofsee | 4e47ac18a1f44e3c08fa78a965b6d382af21f02c40c068be242664a591319049

General

Target

f4c378949afa958856f321735ede56de_JaffaCakes118.exe
Size

11.9MB
MD5

f4c378949afa958856f321735ede56de
SHA1

81209c831cf11aa10f4048958fd87116de600d04
SHA256

4e47ac18a1f44e3c08fa78a965b6d382af21f02c40c068be242664a591319049
SHA512

f1e231061243fb4d5bafddcbe16cbb17df834a608564ea77e33eb34b0630a730eb57c2d5f0cb80e882838f00702e9d169372b58ae5fd8b280c01d6fe65e01a10
SSDEEP

196608:JuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuW:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\mjyoayjh = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2672 netsh.exe

pid	process
2672	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mjyoayjh\ImagePath = "C:\\Windows\\SysWOW64\\mjyoayjh\\ovtejesg.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2412 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

ovtejesg.exe

pid process

2704 ovtejesg.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ovtejesg.exe

description pid process target process

PID 2704 set thread context of 2412 2704 ovtejesg.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2540 sc.exe
2612 sc.exe
2708 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2412	svchost.exe

pid	process
2704	ovtejesg.exe

description	pid	process	target process
PID 2704 set thread context of 2412	2704	ovtejesg.exe	svchost.exe

pid	process
2540	sc.exe
2612	sc.exe
2708	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f4c378949afa958856f321735ede56de_JaffaCakes118.exeovtejesg.exe

description	pid	process	target process
PID 1688 wrote to memory of 2628	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2628	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2628	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2628	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2944	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2944	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2944	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2944	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 1688 wrote to memory of 2612	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2612	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2612	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2612	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2708	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2708	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2708	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2708	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2540	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2540	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2540	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2540	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 1688 wrote to memory of 2672	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 1688 wrote to memory of 2672	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 1688 wrote to memory of 2672	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 1688 wrote to memory of 2672	1688	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 2704 wrote to memory of 2412	2704	ovtejesg.exe	svchost.exe
PID 2704 wrote to memory of 2412	2704	ovtejesg.exe	svchost.exe
PID 2704 wrote to memory of 2412	2704	ovtejesg.exe	svchost.exe
PID 2704 wrote to memory of 2412	2704	ovtejesg.exe	svchost.exe
PID 2704 wrote to memory of 2412	2704	ovtejesg.exe	svchost.exe
PID 2704 wrote to memory of 2412	2704	ovtejesg.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mjyoayjh\
2⤵
PID:2628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ovtejesg.exe" C:\Windows\SysWOW64\mjyoayjh\
2⤵
PID:2944

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create mjyoayjh binPath= "C:\Windows\SysWOW64\mjyoayjh\ovtejesg.exe /d\"C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2612

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description mjyoayjh "wifi internet conection"
2⤵
- Launches sc.exe
PID:2708

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start mjyoayjh
2⤵
- Launches sc.exe
PID:2540

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2672

C:\Windows\SysWOW64\mjyoayjh\ovtejesg.exe
C:\Windows\SysWOW64\mjyoayjh\ovtejesg.exe /d"C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2704

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2412

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ovtejesg.exe
Filesize
14.7MB

MD5
dba3b2944a3139252db8edea8a85d69a

SHA1
53e0722a7d728ad12a11b93c0c63d1f7f96b3bc2

SHA256
7d68c15e934f3957c5411beff8f6eabc4b5abd895eab45fe6cf501ab9e26cc7c

SHA512
582649db1b83129f6c2e7670057d5fcdb052158f49a412cac3b5d3d2256c7a2a7e628a6e905b71cbd48d2487752ebbde9aa75db96e27cdd1faa11ef7d755963a

Download Submit
C:\Windows\SysWOW64\mjyoayjh\ovtejesg.exe
Filesize
192KB

MD5
1742496cc9e5ce100926b686df76fc3a

SHA1
62f13b3e4429aa09a71a7b6832a754e13acac384

SHA256
fa573286de74ab48404086cced767ade27f427dfac3108777f89fe1847d89c64

SHA512
5b79bcbea2bf6b99d055b7c2e9a6bfb983e306e7618c90c5e14c5deb1d00d4ed0e8aec7edcfa092650e0e16f5850aef53143ba7876c9bd7343ae82d7751948f8

Download Submit
memory/1688-3-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1688-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1688-1-0x0000000000610000-0x0000000000710000-memory.dmp

Filesize
1024KB

Download
memory/1688-8-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1688-9-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2412-15-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2412-20-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2412-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-21-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2412-12-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2412-22-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2704-16-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2704-11-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2704-10-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads