tofsee | de6664189711f6d55dd4337ae37167a3feaef197a2a5149d17da8a0a8335f584

General

Target

f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe
Size

14.2MB
MD5

f5e82122b54d4d41824619e647ac946d
SHA1

2e5246a6a5053243e05fb0ec57c53c5f5af4e139
SHA256

de6664189711f6d55dd4337ae37167a3feaef197a2a5149d17da8a0a8335f584
SHA512

59606a4b3babd11a4b927f0a0e470cdb42d2b784be7f75c8a3f9f23376972aa1b98c47ff2cf7c5c30216298e59ab9fcf9681f259bb39fa931fa9c87cf0cade30
SSDEEP

98304:3RoooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooY:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2192 netsh.exe

pid	process
2192	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qwqdzolp\ImagePath = "C:\\Windows\\SysWOW64\\qwqdzolp\\byjomwtq.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

744 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

byjomwtq.exe

pid process

1408 byjomwtq.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

byjomwtq.exe

description pid process target process

PID 1408 set thread context of 744 1408 byjomwtq.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2376 sc.exe
3624 sc.exe
2928 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4068 3988 WerFault.exe f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe
1812 1408 WerFault.exe byjomwtq.exe

pid	process
744	svchost.exe

pid	process
1408	byjomwtq.exe

description	pid	process	target process
PID 1408 set thread context of 744	1408	byjomwtq.exe	svchost.exe

pid	process
2376	sc.exe
3624	sc.exe
2928	sc.exe

pid	pid_target	process	target process
4068	3988	WerFault.exe	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe
1812	1408	WerFault.exe	byjomwtq.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exebyjomwtq.exe

description	pid	process	target process
PID 3988 wrote to memory of 116	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	cmd.exe
PID 3988 wrote to memory of 116	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	cmd.exe
PID 3988 wrote to memory of 116	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	cmd.exe
PID 3988 wrote to memory of 4596	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	cmd.exe
PID 3988 wrote to memory of 4596	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	cmd.exe
PID 3988 wrote to memory of 4596	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	cmd.exe
PID 3988 wrote to memory of 2376	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 2376	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 2376	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 3624	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 3624	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 3624	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 2928	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 2928	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 2928	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	sc.exe
PID 3988 wrote to memory of 2192	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	netsh.exe
PID 3988 wrote to memory of 2192	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	netsh.exe
PID 3988 wrote to memory of 2192	3988	f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe	netsh.exe
PID 1408 wrote to memory of 744	1408	byjomwtq.exe	svchost.exe
PID 1408 wrote to memory of 744	1408	byjomwtq.exe	svchost.exe
PID 1408 wrote to memory of 744	1408	byjomwtq.exe	svchost.exe
PID 1408 wrote to memory of 744	1408	byjomwtq.exe	svchost.exe
PID 1408 wrote to memory of 744	1408	byjomwtq.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qwqdzolp\
2⤵
PID:116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\byjomwtq.exe" C:\Windows\SysWOW64\qwqdzolp\
2⤵
PID:4596

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create qwqdzolp binPath= "C:\Windows\SysWOW64\qwqdzolp\byjomwtq.exe /d\"C:\Users\Admin\AppData\Local\Temp\f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2376

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description qwqdzolp "wifi internet conection"
2⤵
- Launches sc.exe
PID:3624

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start qwqdzolp
2⤵
- Launches sc.exe
PID:2928

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 664
2⤵
- Program crash
PID:4068

C:\Windows\SysWOW64\qwqdzolp\byjomwtq.exe
C:\Windows\SysWOW64\qwqdzolp\byjomwtq.exe /d"C:\Users\Admin\AppData\Local\Temp\f5e82122b54d4d41824619e647ac946d_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 524
2⤵
- Program crash
PID:1812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3988 -ip 3988
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1408 -ip 1408
1⤵
PID:4460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\byjomwtq.exe
Filesize
10.4MB

MD5
ad453fea31820d628a60021145abe3ba

SHA1
40e8a4e6c2f974b1a3a94d7085ff265f50a7e23e

SHA256
cf6d11e8986f949668728148e16e78ada7bca031b913ce97f074e647bc305246

SHA512
68245d7e6bf216a5550261512bb1064f7f9a9298dca76e1427c3a8f7405376e0d56fc32a78e925a171ec934b2871d6fe75c5915ea3ab4771512bab9aae20eaf4

Download Submit
memory/744-16-0x00000000008D0000-0x00000000008E5000-memory.dmp

Filesize
84KB

Download
memory/744-11-0x00000000008D0000-0x00000000008E5000-memory.dmp

Filesize
84KB

Download
memory/744-18-0x00000000008D0000-0x00000000008E5000-memory.dmp

Filesize
84KB

Download
memory/744-19-0x00000000008D0000-0x00000000008E5000-memory.dmp

Filesize
84KB

Download
memory/1408-10-0x00000000006B0000-0x00000000007B0000-memory.dmp

Filesize
1024KB

Download
memory/1408-12-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1408-17-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/3988-4-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/3988-1-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/3988-8-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/3988-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/3988-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads