tofsee | 512389439d20f6c84dce2dfeedfd7096c7e9d8be7369226ca5c1d0814dda567d

General

Target

f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe
Size

12.8MB
MD5

f53649de01295448ee2b6e38609dc159
SHA1

f58d0269d54b7049e91fcfaeac02cad269d654d1
SHA256

512389439d20f6c84dce2dfeedfd7096c7e9d8be7369226ca5c1d0814dda567d
SHA512

fd7641fe88700245d1b44ede2f1b3e28049ba2f25eb6023a0ce103f528faf6f259c14e46cf78fb07336d15b8cf88dbe46ac3d2f87d7d02cb4c091ac0ef7f4d6b
SSDEEP

49152:o3SkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkU:o3

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

560 netsh.exe

pid	process
560	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qshudsdm\ImagePath = "C:\\Windows\\SysWOW64\\qshudsdm\\xbisgtbr.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\Control Panel\International\Geo\Nation	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1644 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

xbisgtbr.exe

pid process

2144 xbisgtbr.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xbisgtbr.exe

description pid process target process

PID 2144 set thread context of 1644 2144 xbisgtbr.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

920 sc.exe
4656 sc.exe
3972 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

404 3400 WerFault.exe f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe
1536 2144 WerFault.exe xbisgtbr.exe

pid	process
1644	svchost.exe

pid	process
2144	xbisgtbr.exe

description	pid	process	target process
PID 2144 set thread context of 1644	2144	xbisgtbr.exe	svchost.exe

pid	process
920	sc.exe
4656	sc.exe
3972	sc.exe

pid	pid_target	process	target process
404	3400	WerFault.exe	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe
1536	2144	WerFault.exe	xbisgtbr.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f53649de01295448ee2b6e38609dc159_JaffaCakes118.exexbisgtbr.exe

description	pid	process	target process
PID 3400 wrote to memory of 2980	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	cmd.exe
PID 3400 wrote to memory of 2980	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	cmd.exe
PID 3400 wrote to memory of 2980	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	cmd.exe
PID 3400 wrote to memory of 1984	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	cmd.exe
PID 3400 wrote to memory of 1984	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	cmd.exe
PID 3400 wrote to memory of 1984	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	cmd.exe
PID 3400 wrote to memory of 3972	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 3972	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 3972	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 920	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 920	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 920	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 4656	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 4656	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 4656	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	sc.exe
PID 3400 wrote to memory of 560	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	netsh.exe
PID 3400 wrote to memory of 560	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	netsh.exe
PID 3400 wrote to memory of 560	3400	f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe	netsh.exe
PID 2144 wrote to memory of 1644	2144	xbisgtbr.exe	svchost.exe
PID 2144 wrote to memory of 1644	2144	xbisgtbr.exe	svchost.exe
PID 2144 wrote to memory of 1644	2144	xbisgtbr.exe	svchost.exe
PID 2144 wrote to memory of 1644	2144	xbisgtbr.exe	svchost.exe
PID 2144 wrote to memory of 1644	2144	xbisgtbr.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qshudsdm\
2⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xbisgtbr.exe" C:\Windows\SysWOW64\qshudsdm\
2⤵
PID:1984

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create qshudsdm binPath= "C:\Windows\SysWOW64\qshudsdm\xbisgtbr.exe /d\"C:\Users\Admin\AppData\Local\Temp\f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:3972

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description qshudsdm "wifi internet conection"
2⤵
- Launches sc.exe
PID:920

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start qshudsdm
2⤵
- Launches sc.exe
PID:4656

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 664
2⤵
- Program crash
PID:404

C:\Windows\SysWOW64\qshudsdm\xbisgtbr.exe
C:\Windows\SysWOW64\qshudsdm\xbisgtbr.exe /d"C:\Users\Admin\AppData\Local\Temp\f53649de01295448ee2b6e38609dc159_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 508
2⤵
- Program crash
PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3400 -ip 3400
1⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2144 -ip 2144
1⤵
PID:3976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xbisgtbr.exe
Filesize
10.5MB

MD5
cd0c5a98f6b0929c72061c903d9edb72

SHA1
8465035fb33a4b1458a76de3c82e2f807efa65a0

SHA256
8f194add8b297add2b6966cc2d79f86589cd4a7ab14cd3b1fef64167ba2edfd2

SHA512
a8e3f66b22c17b13f6848004a4f2c6e4986ff51de61eccfadbec5305c852c6765813e592d43e2e7819ecf493337e42f84f89db0da6c3f7c4c38460d3380c082f

Download Submit
memory/1644-16-0x0000000001060000-0x0000000001075000-memory.dmp

Filesize
84KB

Download
memory/1644-12-0x0000000001060000-0x0000000001075000-memory.dmp

Filesize
84KB

Download
memory/1644-18-0x0000000001060000-0x0000000001075000-memory.dmp

Filesize
84KB

Download
memory/1644-19-0x0000000001060000-0x0000000001075000-memory.dmp

Filesize
84KB

Download
memory/2144-11-0x0000000000E80000-0x0000000000F80000-memory.dmp

Filesize
1024KB

Download
memory/2144-13-0x0000000000400000-0x0000000000C14000-memory.dmp

Filesize
8.1MB

Download
memory/2144-17-0x0000000000400000-0x0000000000C14000-memory.dmp

Filesize
8.1MB

Download
memory/3400-4-0x0000000000400000-0x0000000000C14000-memory.dmp

Filesize
8.1MB

Download
memory/3400-2-0x0000000002960000-0x0000000002973000-memory.dmp

Filesize
76KB

Download
memory/3400-7-0x0000000000400000-0x0000000000C14000-memory.dmp

Filesize
8.1MB

Download
memory/3400-9-0x0000000002960000-0x0000000002973000-memory.dmp

Filesize
76KB

Download
memory/3400-1-0x0000000000D50000-0x0000000000E50000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads