tofsee | 1dd18b571a7f0c1aa7dab349223d00dfe5d77a1ade424294e146e27f0711f9c4

General

Target

f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe
Size

13.5MB
MD5

f556b46080b93cac81ba2773afed7bc2
SHA1

8be59c47609a82572e2e4763d29d9385819116df
SHA256

1dd18b571a7f0c1aa7dab349223d00dfe5d77a1ade424294e146e27f0711f9c4
SHA512

0923bba76971117e1ca4cc8dee3269fc9673162486af8fc18a997db5cbbfdf5730f5c6375edc9134d4e7d9ab4a182c74eed47d29ef09fda53dfc010fa855c638
SSDEEP

12288:QIIW7A7qL8SHSIiwN/iZBqAsArTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTD:RA7qLNNf

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\jemadsyg = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2508 netsh.exe

pid	process
2508	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jemadsyg\ImagePath = "C:\\Windows\\SysWOW64\\jemadsyg\\eexkwtsu.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2436 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

eexkwtsu.exe

pid process

2396 eexkwtsu.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

eexkwtsu.exe

description pid process target process

PID 2396 set thread context of 2436 2396 eexkwtsu.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2984 sc.exe
2688 sc.exe
892 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2436	svchost.exe

pid	process
2396	eexkwtsu.exe

description	pid	process	target process
PID 2396 set thread context of 2436	2396	eexkwtsu.exe	svchost.exe

pid	process
2984	sc.exe
2688	sc.exe
892	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exeeexkwtsu.exe

description	pid	process	target process
PID 1292 wrote to memory of 2512	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2512	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2512	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2512	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2568	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2568	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2568	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2568	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	cmd.exe
PID 1292 wrote to memory of 2984	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2984	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2984	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2984	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2688	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2688	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2688	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2688	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 892	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 892	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 892	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 892	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	sc.exe
PID 1292 wrote to memory of 2508	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	netsh.exe
PID 1292 wrote to memory of 2508	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	netsh.exe
PID 1292 wrote to memory of 2508	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	netsh.exe
PID 1292 wrote to memory of 2508	1292	f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe	netsh.exe
PID 2396 wrote to memory of 2436	2396	eexkwtsu.exe	svchost.exe
PID 2396 wrote to memory of 2436	2396	eexkwtsu.exe	svchost.exe
PID 2396 wrote to memory of 2436	2396	eexkwtsu.exe	svchost.exe
PID 2396 wrote to memory of 2436	2396	eexkwtsu.exe	svchost.exe
PID 2396 wrote to memory of 2436	2396	eexkwtsu.exe	svchost.exe
PID 2396 wrote to memory of 2436	2396	eexkwtsu.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jemadsyg\
2⤵
PID:2512

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\eexkwtsu.exe" C:\Windows\SysWOW64\jemadsyg\
2⤵
PID:2568

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create jemadsyg binPath= "C:\Windows\SysWOW64\jemadsyg\eexkwtsu.exe /d\"C:\Users\Admin\AppData\Local\Temp\f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2984

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description jemadsyg "wifi internet conection"
2⤵
- Launches sc.exe
PID:2688

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start jemadsyg
2⤵
- Launches sc.exe
PID:892

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2508

C:\Windows\SysWOW64\jemadsyg\eexkwtsu.exe
C:\Windows\SysWOW64\jemadsyg\eexkwtsu.exe /d"C:\Users\Admin\AppData\Local\Temp\f556b46080b93cac81ba2773afed7bc2_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2436

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eexkwtsu.exe
Filesize
11.9MB

MD5
1a662312fa3cba8cacb69c99f7184da5

SHA1
75df71b9df1c5e37a81987a738b6a7c46a19bf46

SHA256
4e40535c85b376e12f6ae27d89b134f95aa827883109be87a81f470deced3947

SHA512
efe9989a965b9b9bf77276b25792f2935a691c94242cf7c4ea46eadb7c24c32e53b7ec46460e9df932fd1b7dfd1fd949d14a353a9461053f613d5cb7efb5ea11

Download Submit
memory/1292-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/1292-4-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1292-1-0x0000000000630000-0x0000000000730000-memory.dmp

Filesize
1024KB

Download
memory/1292-8-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2396-15-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2396-14-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2436-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2436-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2436-12-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2436-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2436-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2436-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads