tofsee | 4e47ac18a1f44e3c08fa78a965b6d382af21f02c40c068be242664a591319049

General

Target

f4c378949afa958856f321735ede56de_JaffaCakes118.exe
Size

11.9MB
MD5

f4c378949afa958856f321735ede56de
SHA1

81209c831cf11aa10f4048958fd87116de600d04
SHA256

4e47ac18a1f44e3c08fa78a965b6d382af21f02c40c068be242664a591319049
SHA512

f1e231061243fb4d5bafddcbe16cbb17df834a608564ea77e33eb34b0630a730eb57c2d5f0cb80e882838f00702e9d169372b58ae5fd8b280c01d6fe65e01a10
SSDEEP

196608:JuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuW:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

828 netsh.exe

pid	process
828	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\jtxtnbki\ImagePath = "C:\\Windows\\SysWOW64\\jtxtnbki\\ykrlqwjr.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f4c378949afa958856f321735ede56de_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	f4c378949afa958856f321735ede56de_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4192 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

ykrlqwjr.exe

pid process

2188 ykrlqwjr.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ykrlqwjr.exe

description pid process target process

PID 2188 set thread context of 4192 2188 ykrlqwjr.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3708 sc.exe
452 sc.exe
1900 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1740 4144 WerFault.exe f4c378949afa958856f321735ede56de_JaffaCakes118.exe
4604 2188 WerFault.exe ykrlqwjr.exe

pid	process
4192	svchost.exe

pid	process
2188	ykrlqwjr.exe

description	pid	process	target process
PID 2188 set thread context of 4192	2188	ykrlqwjr.exe	svchost.exe

pid	process
3708	sc.exe
452	sc.exe
1900	sc.exe

pid	pid_target	process	target process
1740	4144	WerFault.exe	f4c378949afa958856f321735ede56de_JaffaCakes118.exe
4604	2188	WerFault.exe	ykrlqwjr.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f4c378949afa958856f321735ede56de_JaffaCakes118.exeykrlqwjr.exe

description	pid	process	target process
PID 4144 wrote to memory of 3596	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 4144 wrote to memory of 3596	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 4144 wrote to memory of 3596	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 4144 wrote to memory of 1428	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 4144 wrote to memory of 1428	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 4144 wrote to memory of 1428	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	cmd.exe
PID 4144 wrote to memory of 1900	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 1900	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 1900	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 3708	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 3708	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 3708	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 452	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 452	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 452	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	sc.exe
PID 4144 wrote to memory of 828	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 4144 wrote to memory of 828	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 4144 wrote to memory of 828	4144	f4c378949afa958856f321735ede56de_JaffaCakes118.exe	netsh.exe
PID 2188 wrote to memory of 4192	2188	ykrlqwjr.exe	svchost.exe
PID 2188 wrote to memory of 4192	2188	ykrlqwjr.exe	svchost.exe
PID 2188 wrote to memory of 4192	2188	ykrlqwjr.exe	svchost.exe
PID 2188 wrote to memory of 4192	2188	ykrlqwjr.exe	svchost.exe
PID 2188 wrote to memory of 4192	2188	ykrlqwjr.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jtxtnbki\
2⤵
PID:3596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ykrlqwjr.exe" C:\Windows\SysWOW64\jtxtnbki\
2⤵
PID:1428

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create jtxtnbki binPath= "C:\Windows\SysWOW64\jtxtnbki\ykrlqwjr.exe /d\"C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1900

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description jtxtnbki "wifi internet conection"
2⤵
- Launches sc.exe
PID:3708

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start jtxtnbki
2⤵
- Launches sc.exe
PID:452

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1032
2⤵
- Program crash
PID:1740

C:\Windows\SysWOW64\jtxtnbki\ykrlqwjr.exe
C:\Windows\SysWOW64\jtxtnbki\ykrlqwjr.exe /d"C:\Users\Admin\AppData\Local\Temp\f4c378949afa958856f321735ede56de_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 512
2⤵
- Program crash
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4144 -ip 4144
1⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2188 -ip 2188
1⤵
PID:3528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ykrlqwjr.exe
Filesize
14.7MB

MD5
dba3b2944a3139252db8edea8a85d69a

SHA1
53e0722a7d728ad12a11b93c0c63d1f7f96b3bc2

SHA256
7d68c15e934f3957c5411beff8f6eabc4b5abd895eab45fe6cf501ab9e26cc7c

SHA512
582649db1b83129f6c2e7670057d5fcdb052158f49a412cac3b5d3d2256c7a2a7e628a6e905b71cbd48d2487752ebbde9aa75db96e27cdd1faa11ef7d755963a

Download Submit
memory/2188-10-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/2188-12-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/2188-17-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4144-4-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4144-2-0x0000000000760000-0x0000000000773000-memory.dmp

Filesize
76KB

Download
memory/4144-8-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/4144-9-0x0000000000760000-0x0000000000773000-memory.dmp

Filesize
76KB

Download
memory/4144-1-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/4192-11-0x00000000006C0000-0x00000000006D5000-memory.dmp

Filesize
84KB

Download
memory/4192-15-0x00000000006C0000-0x00000000006D5000-memory.dmp

Filesize
84KB

Download
memory/4192-16-0x00000000006C0000-0x00000000006D5000-memory.dmp

Filesize
84KB

Download
memory/4192-18-0x00000000006C0000-0x00000000006D5000-memory.dmp

Filesize
84KB

Download
memory/4192-19-0x00000000006C0000-0x00000000006D5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads