tofsee | ad7b781f8819aa7dfcb0e9a36f308f28c2db7527513e6ece4349403bcc19c14b

General

Target

f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe
Size

10.9MB
MD5

f53606c76e4e29c00b8c7ccedb02e2a0
SHA1

e26a2701d9cc62efbeae4d5a21ada244f295a4a7
SHA256

ad7b781f8819aa7dfcb0e9a36f308f28c2db7527513e6ece4349403bcc19c14b
SHA512

2f682a92d7971231b08485102e9c3d6e63f5910ce093fdddb90728fc931b7413b21899dfeb35db19f9f48a20b76da5031e8f1cbb28537641ab26c1a823e20cc3
SSDEEP

24576:4htJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuO:BF

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4880 netsh.exe

pid	process
4880	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\olprdbme\ImagePath = "C:\\Windows\\SysWOW64\\olprdbme\\asbjgtfz.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4248 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

asbjgtfz.exe

pid process

5080 asbjgtfz.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

asbjgtfz.exe

description pid process target process

PID 5080 set thread context of 4248 5080 asbjgtfz.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1284 sc.exe
1424 sc.exe
1896 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1952 4732 WerFault.exe f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe
1260 5080 WerFault.exe asbjgtfz.exe

pid	process
4248	svchost.exe

pid	process
5080	asbjgtfz.exe

description	pid	process	target process
PID 5080 set thread context of 4248	5080	asbjgtfz.exe	svchost.exe

pid	process
1284	sc.exe
1424	sc.exe
1896	sc.exe

pid	pid_target	process	target process
1952	4732	WerFault.exe	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe
1260	5080	WerFault.exe	asbjgtfz.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exeasbjgtfz.exe

description	pid	process	target process
PID 4732 wrote to memory of 3060	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	cmd.exe
PID 4732 wrote to memory of 3060	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	cmd.exe
PID 4732 wrote to memory of 3060	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	cmd.exe
PID 4732 wrote to memory of 3568	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	cmd.exe
PID 4732 wrote to memory of 3568	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	cmd.exe
PID 4732 wrote to memory of 3568	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	cmd.exe
PID 4732 wrote to memory of 1284	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1284	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1284	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1424	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1424	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1424	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1896	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1896	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 1896	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	sc.exe
PID 4732 wrote to memory of 4880	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	netsh.exe
PID 4732 wrote to memory of 4880	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	netsh.exe
PID 4732 wrote to memory of 4880	4732	f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe	netsh.exe
PID 5080 wrote to memory of 4248	5080	asbjgtfz.exe	svchost.exe
PID 5080 wrote to memory of 4248	5080	asbjgtfz.exe	svchost.exe
PID 5080 wrote to memory of 4248	5080	asbjgtfz.exe	svchost.exe
PID 5080 wrote to memory of 4248	5080	asbjgtfz.exe	svchost.exe
PID 5080 wrote to memory of 4248	5080	asbjgtfz.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olprdbme\
2⤵
PID:3060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\asbjgtfz.exe" C:\Windows\SysWOW64\olprdbme\
2⤵
PID:3568

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create olprdbme binPath= "C:\Windows\SysWOW64\olprdbme\asbjgtfz.exe /d\"C:\Users\Admin\AppData\Local\Temp\f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1284

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description olprdbme "wifi internet conection"
2⤵
- Launches sc.exe
PID:1424

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start olprdbme
2⤵
- Launches sc.exe
PID:1896

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 628
2⤵
- Program crash
PID:1952

C:\Windows\SysWOW64\olprdbme\asbjgtfz.exe
C:\Windows\SysWOW64\olprdbme\asbjgtfz.exe /d"C:\Users\Admin\AppData\Local\Temp\f53606c76e4e29c00b8c7ccedb02e2a0_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 512
2⤵
- Program crash
PID:1260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4732 -ip 4732
1⤵
PID:4900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5080 -ip 5080
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asbjgtfz.exe

Filesize
13.8MB

MD5
d2798168e684ac2b4e872f57e72181e3

SHA1
5dd2eed1db81abb0605d7f29c684feaa2e0a99e4

SHA256
3d5c9d4af346afff2bceb55188d2bee9d8d70e5136004309e5578c9bc0deeb9f

SHA512
944015aeaf53c82dfe39c5a6b8847c1f06e5aed6bde55d08e1a977a262d4366e5ba0ae9ddab7503eab3d56174f6170b9ab96c60307b2a0d02ab4efc25781f60f

Download Submit
memory/4248-15-0x00000000005A0000-0x00000000005B5000-memory.dmp

Filesize
84KB

Download
memory/4248-12-0x00000000005A0000-0x00000000005B5000-memory.dmp

Filesize
84KB

Download
memory/4248-16-0x00000000005A0000-0x00000000005B5000-memory.dmp

Filesize
84KB

Download
memory/4248-18-0x00000000005A0000-0x00000000005B5000-memory.dmp

Filesize
84KB

Download
memory/4248-19-0x00000000005A0000-0x00000000005B5000-memory.dmp

Filesize
84KB

Download
memory/4732-3-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4732-2-0x00000000005B0000-0x00000000005C3000-memory.dmp

Filesize
76KB

Download
memory/4732-8-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4732-9-0x00000000005B0000-0x00000000005C3000-memory.dmp

Filesize
76KB

Download
memory/4732-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/5080-10-0x00000000005F0000-0x00000000006F0000-memory.dmp

Filesize
1024KB

Download
memory/5080-11-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/5080-17-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads