tofsee | 8fef051011edd55ad9fc409b8c219c0163ad76e51ccf7de04af425e3c65bcf26

General

Target

f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe
Size

14.2MB
MD5

f738ea71fba2f31d93643ceea356012b
SHA1

c2e376f784dc822841847b899564ec54ed76731c
SHA256

8fef051011edd55ad9fc409b8c219c0163ad76e51ccf7de04af425e3c65bcf26
SHA512

abd78b9573b6a8dbe7e02fd4ee984eb1a8c4c0c5b8db3997f766e44c52621ab2a54608a0a75754eaa969237704828aa157f7da1eaa2c2cc7ce1c59e8d9edc9b3
SSDEEP

196608:wOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOz:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qzttoark = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1264 netsh.exe

pid	process
1264	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qzttoark\ImagePath = "C:\\Windows\\SysWOW64\\qzttoark\\kqloxggb.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

464 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

kqloxggb.exe

pid process

2244 kqloxggb.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

kqloxggb.exe

description pid process target process

PID 2244 set thread context of 464 2244 kqloxggb.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1416 sc.exe
1272 sc.exe
1532 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
464	svchost.exe

pid	process
2244	kqloxggb.exe

description	pid	process	target process
PID 2244 set thread context of 464	2244	kqloxggb.exe	svchost.exe

pid	process
1416	sc.exe
1272	sc.exe
1532	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exekqloxggb.exe

description	pid	process	target process
PID 2228 wrote to memory of 1328	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1328	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1328	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1328	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1204	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1204	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1204	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1204	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	cmd.exe
PID 2228 wrote to memory of 1532	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1532	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1532	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1532	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1416	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1416	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1416	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1416	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1272	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1272	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1272	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1272	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	sc.exe
PID 2228 wrote to memory of 1264	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	netsh.exe
PID 2228 wrote to memory of 1264	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	netsh.exe
PID 2228 wrote to memory of 1264	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	netsh.exe
PID 2228 wrote to memory of 1264	2228	f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe	netsh.exe
PID 2244 wrote to memory of 464	2244	kqloxggb.exe	svchost.exe
PID 2244 wrote to memory of 464	2244	kqloxggb.exe	svchost.exe
PID 2244 wrote to memory of 464	2244	kqloxggb.exe	svchost.exe
PID 2244 wrote to memory of 464	2244	kqloxggb.exe	svchost.exe
PID 2244 wrote to memory of 464	2244	kqloxggb.exe	svchost.exe
PID 2244 wrote to memory of 464	2244	kqloxggb.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qzttoark\
2⤵
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kqloxggb.exe" C:\Windows\SysWOW64\qzttoark\
2⤵
PID:1204

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create qzttoark binPath= "C:\Windows\SysWOW64\qzttoark\kqloxggb.exe /d\"C:\Users\Admin\AppData\Local\Temp\f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1532

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description qzttoark "wifi internet conection"
2⤵
- Launches sc.exe
PID:1416

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start qzttoark
2⤵
- Launches sc.exe
PID:1272

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1264

C:\Windows\SysWOW64\qzttoark\kqloxggb.exe
C:\Windows\SysWOW64\qzttoark\kqloxggb.exe /d"C:\Users\Admin\AppData\Local\Temp\f738ea71fba2f31d93643ceea356012b_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kqloxggb.exe

Filesize
12.0MB

MD5
59ce71865386ffa41acdaefae0a661ed

SHA1
14a4a158d2f52278a9cb4440d6f9326c8d54f51a

SHA256
be7d6f798d08ffa0f761ff131988796a58cf6a20aed8d2b63e442f5377de63b7

SHA512
1cb0e1ded0722b63ba5f8117aecb6ed0b2a72dbd4bf9ba4b29bd99afbef4b758bb56af73c3391811b7ce5dcfe205065dbf9bdab6146d7a818fc3571dab051b64

Download Submit
memory/464-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/464-23-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/464-22-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/464-21-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/464-18-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/464-15-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/464-12-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/2228-8-0x0000000000400000-0x0000000002F11000-memory.dmp

Filesize
43.1MB

Download
memory/2228-9-0x0000000003040000-0x0000000003140000-memory.dmp

Filesize
1024KB

Download
memory/2228-10-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2228-1-0x0000000003040000-0x0000000003140000-memory.dmp

Filesize
1024KB

Download
memory/2228-4-0x0000000000400000-0x0000000002F11000-memory.dmp

Filesize
43.1MB

Download
memory/2228-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2244-11-0x0000000002FE0000-0x00000000030E0000-memory.dmp

Filesize
1024KB

Download
memory/2244-20-0x0000000000400000-0x0000000002F11000-memory.dmp

Filesize
43.1MB

Download
memory/2244-19-0x0000000000400000-0x0000000002F11000-memory.dmp

Filesize
43.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads