tofsee | 33f705632625e6e1ead56838de42648696c964f1984578ce30998e008f854ebe

General

Target

f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe
Size

13.9MB
MD5

f75d6b1dffda8c5730718cab5dd19616
SHA1

f75b81e452246d015f51314b6bdb1a8eb67bbf9a
SHA256

33f705632625e6e1ead56838de42648696c964f1984578ce30998e008f854ebe
SHA512

3cb83f943d23e667fbcad24c8f754a4359bdccc31efb950d4a8e3b5fcb274935a93afc01fb59c33282a499d9e61e6dd04d68064e0f3c8f0b704e598535ce66e0
SSDEEP

6144:OJu3szifRNFyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyH:8uHf7

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hnjprljb = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2384 netsh.exe

pid	process
2384	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hnjprljb\ImagePath = "C:\\Windows\\SysWOW64\\hnjprljb\\hgwszva.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2916 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

hgwszva.exe

pid process

2688 hgwszva.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

hgwszva.exe

description pid process target process

PID 2688 set thread context of 2916 2688 hgwszva.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2228 sc.exe
2608 sc.exe
2700 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2916	svchost.exe

pid	process
2688	hgwszva.exe

description	pid	process	target process
PID 2688 set thread context of 2916	2688	hgwszva.exe	svchost.exe

pid	process
2228	sc.exe
2608	sc.exe
2700	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exehgwszva.exe

description	pid	process	target process
PID 2240 wrote to memory of 2712	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2712	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2712	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2712	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2212	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2212	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2212	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2212	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	cmd.exe
PID 2240 wrote to memory of 2228	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2228	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2228	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2228	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2608	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2608	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2608	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2608	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2700	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2700	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2700	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2240 wrote to memory of 2700	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	sc.exe
PID 2688 wrote to memory of 2916	2688	hgwszva.exe	svchost.exe
PID 2688 wrote to memory of 2916	2688	hgwszva.exe	svchost.exe
PID 2688 wrote to memory of 2916	2688	hgwszva.exe	svchost.exe
PID 2688 wrote to memory of 2916	2688	hgwszva.exe	svchost.exe
PID 2688 wrote to memory of 2916	2688	hgwszva.exe	svchost.exe
PID 2688 wrote to memory of 2916	2688	hgwszva.exe	svchost.exe
PID 2240 wrote to memory of 2384	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	netsh.exe
PID 2240 wrote to memory of 2384	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	netsh.exe
PID 2240 wrote to memory of 2384	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	netsh.exe
PID 2240 wrote to memory of 2384	2240	f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hnjprljb\
2⤵
PID:2712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hgwszva.exe" C:\Windows\SysWOW64\hnjprljb\
2⤵
PID:2212

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create hnjprljb binPath= "C:\Windows\SysWOW64\hnjprljb\hgwszva.exe /d\"C:\Users\Admin\AppData\Local\Temp\f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2228

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description hnjprljb "wifi internet conection"
2⤵
- Launches sc.exe
PID:2608

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start hnjprljb
2⤵
- Launches sc.exe
PID:2700

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2384

C:\Windows\SysWOW64\hnjprljb\hgwszva.exe
C:\Windows\SysWOW64\hnjprljb\hgwszva.exe /d"C:\Users\Admin\AppData\Local\Temp\f75d6b1dffda8c5730718cab5dd19616_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\hgwszva.exe
Filesize
12.4MB

MD5
cbaa7a8a17572aee06605e0c8eabb5ba

SHA1
85e259477c0c8e6d184ee8c200d3279a0f77f331

SHA256
e7c7b6e44746764d513ceaa269c3941bae4bcaede140558aa96e935958a01539

SHA512
ee650cd5c5823e5ff8e0ad9716b6dbdbe06dec73f1fef4e60325e8c4ece2b71ca78840402346ec8ca8753c4c256e7e85940b1aace3203bf692d6cef395d2f99f

Download Submit
memory/2240-15-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2240-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2240-1-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2240-2-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2688-12-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2916-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2916-7-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2916-10-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2916-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2916-16-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2916-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2916-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads