tofsee | d4ca44f11b84cb185a779b6beb43f3317ffe91cf08d67a8da639764151a79d1e

General

Target

f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe
Size

10.1MB
MD5

f8d62bc2e174e624fd63ded004a3ca94
SHA1

2b3e1baa0a7407f1627e6349d044eada991b5452
SHA256

d4ca44f11b84cb185a779b6beb43f3317ffe91cf08d67a8da639764151a79d1e
SHA512

7b67a2403813a48103fdda53dd665b3e96d9b859dfdfbd044e85f52bdd3e17953f044e78c22e2935e17724df8b10491f9727dbce5d88c8e37ca35f17bef565f6
SSDEEP

24576:6URprj37+W55555555555555555555555555555555555555555555555555555n:1TP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4364 netsh.exe

pid	process
4364	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oxkbeqcl\ImagePath = "C:\\Windows\\SysWOW64\\oxkbeqcl\\czkwqrv.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

888 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

czkwqrv.exe

pid process

4028 czkwqrv.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

czkwqrv.exe

description pid process target process

PID 4028 set thread context of 888 4028 czkwqrv.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4068 sc.exe
468 sc.exe
2292 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
888	svchost.exe

pid	process
4028	czkwqrv.exe

description	pid	process	target process
PID 4028 set thread context of 888	4028	czkwqrv.exe	svchost.exe

pid	process
4068	sc.exe
468	sc.exe
2292	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.execzkwqrv.exe

description	pid	process	target process
PID 2996 wrote to memory of 4760	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 4760	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 4760	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 3032	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 3032	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 3032	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	cmd.exe
PID 2996 wrote to memory of 4068	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 4068	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 4068	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 468	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 468	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 468	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 2292	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 2292	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 2292	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	sc.exe
PID 2996 wrote to memory of 4364	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	netsh.exe
PID 2996 wrote to memory of 4364	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	netsh.exe
PID 2996 wrote to memory of 4364	2996	f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe	netsh.exe
PID 4028 wrote to memory of 888	4028	czkwqrv.exe	svchost.exe
PID 4028 wrote to memory of 888	4028	czkwqrv.exe	svchost.exe
PID 4028 wrote to memory of 888	4028	czkwqrv.exe	svchost.exe
PID 4028 wrote to memory of 888	4028	czkwqrv.exe	svchost.exe
PID 4028 wrote to memory of 888	4028	czkwqrv.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\oxkbeqcl\
2⤵
PID:4760

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\czkwqrv.exe" C:\Windows\SysWOW64\oxkbeqcl\
2⤵
PID:3032

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create oxkbeqcl binPath= "C:\Windows\SysWOW64\oxkbeqcl\czkwqrv.exe /d\"C:\Users\Admin\AppData\Local\Temp\f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4068

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description oxkbeqcl "wifi internet conection"
2⤵
- Launches sc.exe
PID:468

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start oxkbeqcl
2⤵
- Launches sc.exe
PID:2292

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4364

C:\Windows\SysWOW64\oxkbeqcl\czkwqrv.exe
C:\Windows\SysWOW64\oxkbeqcl\czkwqrv.exe /d"C:\Users\Admin\AppData\Local\Temp\f8d62bc2e174e624fd63ded004a3ca94_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:888

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\czkwqrv.exe
Filesize
13.2MB

MD5
ab4f4735330982254c35a15ff360ed07

SHA1
8d5b014cd18dbb2e0f5206961f48825ab6b22dc9

SHA256
f466028629bc8c7217bdbb98337b82bd1597149f3c0e74ef77d7154a39548154

SHA512
bc375e51a22508f8a314474bed10246dc076bab256be0328c14fbdd6a3d1740911fa33ecf791e6d0e013ccd9a6b6397dda491aa39ef1ea6277148ecb50d95e46

Download Submit
memory/888-13-0x0000000000780000-0x0000000000795000-memory.dmp

Filesize
84KB

Download
memory/888-9-0x0000000000780000-0x0000000000795000-memory.dmp

Filesize
84KB

Download
memory/888-14-0x0000000000780000-0x0000000000795000-memory.dmp

Filesize
84KB

Download
memory/888-15-0x0000000000780000-0x0000000000795000-memory.dmp

Filesize
84KB

Download
memory/888-16-0x0000000000780000-0x0000000000795000-memory.dmp

Filesize
84KB

Download
memory/2996-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/2996-2-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/2996-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2996-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4028-8-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4028-7-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/4028-10-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads