tofsee | aca4d1f950e385f84ded0ae2390f84b83a946ea27888616363082fd92ba8677c

General

Target

f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe
Size

14.2MB
MD5

f4d7ce748f02842afc6d0fe61c4e2944
SHA1

b4ab92d482f695405bf7e0b300553fcd1312abc2
SHA256

aca4d1f950e385f84ded0ae2390f84b83a946ea27888616363082fd92ba8677c
SHA512

c23623fabec8a3b69224c98518db8239f07beb5a272e667f77aee01963807e0b2fb5ef9fcfe4294401c376f44d024f0eaeccbfe072fb1c4c933ed3166fefe8fd
SSDEEP

98304:hjhd88888888888888888888888888888888888888888888888888888888888:h

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

176.111.174.19

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

380 netsh.exe

pid	process
380	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\nizakkhe\ImagePath = "C:\\Windows\\SysWOW64\\nizakkhe\\tbisnlin.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4684 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

tbisnlin.exe

pid process

2768 tbisnlin.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

tbisnlin.exe

description pid process target process

PID 2768 set thread context of 4684 2768 tbisnlin.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4596 sc.exe
1208 sc.exe
4880 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3968 2016 WerFault.exe f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe
1760 2768 WerFault.exe tbisnlin.exe

pid	process
4684	svchost.exe

pid	process
2768	tbisnlin.exe

description	pid	process	target process
PID 2768 set thread context of 4684	2768	tbisnlin.exe	svchost.exe

pid	process
4596	sc.exe
1208	sc.exe
4880	sc.exe

pid	pid_target	process	target process
3968	2016	WerFault.exe	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe
1760	2768	WerFault.exe	tbisnlin.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exetbisnlin.exe

description	pid	process	target process
PID 2016 wrote to memory of 2424	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	cmd.exe
PID 2016 wrote to memory of 2424	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	cmd.exe
PID 2016 wrote to memory of 2424	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	cmd.exe
PID 2016 wrote to memory of 3664	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	cmd.exe
PID 2016 wrote to memory of 3664	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	cmd.exe
PID 2016 wrote to memory of 3664	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	cmd.exe
PID 2016 wrote to memory of 4596	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 4596	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 4596	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 1208	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 1208	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 1208	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 4880	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 4880	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 4880	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	sc.exe
PID 2016 wrote to memory of 380	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	netsh.exe
PID 2016 wrote to memory of 380	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	netsh.exe
PID 2016 wrote to memory of 380	2016	f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe	netsh.exe
PID 2768 wrote to memory of 4684	2768	tbisnlin.exe	svchost.exe
PID 2768 wrote to memory of 4684	2768	tbisnlin.exe	svchost.exe
PID 2768 wrote to memory of 4684	2768	tbisnlin.exe	svchost.exe
PID 2768 wrote to memory of 4684	2768	tbisnlin.exe	svchost.exe
PID 2768 wrote to memory of 4684	2768	tbisnlin.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nizakkhe\
2⤵
PID:2424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tbisnlin.exe" C:\Windows\SysWOW64\nizakkhe\
2⤵
PID:3664

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create nizakkhe binPath= "C:\Windows\SysWOW64\nizakkhe\tbisnlin.exe /d\"C:\Users\Admin\AppData\Local\Temp\f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4596

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description nizakkhe "wifi internet conection"
2⤵
- Launches sc.exe
PID:1208

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start nizakkhe
2⤵
- Launches sc.exe
PID:4880

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1044
2⤵
- Program crash
PID:3968

C:\Windows\SysWOW64\nizakkhe\tbisnlin.exe
C:\Windows\SysWOW64\nizakkhe\tbisnlin.exe /d"C:\Users\Admin\AppData\Local\Temp\f4d7ce748f02842afc6d0fe61c4e2944_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 516
2⤵
- Program crash
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2016 -ip 2016
1⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2768 -ip 2768
1⤵
PID:2356

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tbisnlin.exe
Filesize
10.6MB

MD5
5c0d9a2aebe93c5b9d80ebfe1d45be6f

SHA1
6ba4ff92ae07a725a5f6150710baab95d6f0b9f3

SHA256
93a216f5814c73349d7ca18e94fe1534b8b01e7561b09c64a9134bbe65e74995

SHA512
9966fa4c4138daa005342395cc2d8073f4237fb57200dd4e7ccc7298edea1c1548e4140aaba0d843da70975ca455dd68dd2e2566ac370112674bf59600cb0cbc

Download Submit
memory/2016-1-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2016-2-0x0000000000530000-0x0000000000543000-memory.dmp

Filesize
76KB

Download
memory/2016-3-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2016-7-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2016-8-0x0000000000530000-0x0000000000543000-memory.dmp

Filesize
76KB

Download
memory/2768-11-0x00000000006C0000-0x00000000007C0000-memory.dmp

Filesize
1024KB

Download
memory/2768-12-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2768-18-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4684-10-0x0000000000900000-0x0000000000915000-memory.dmp

Filesize
84KB

Download
memory/4684-16-0x0000000000900000-0x0000000000915000-memory.dmp

Filesize
84KB

Download
memory/4684-17-0x0000000000900000-0x0000000000915000-memory.dmp

Filesize
84KB

Download
memory/4684-19-0x0000000000900000-0x0000000000915000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads