tofsee | fa409a4ec066822a97f2e0b0e47a7f4ce9ea3d60025047252511719856cbbd4b

General

Target

fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe
Size

10.5MB
MD5

fb3e27d3a1c7970ab760ce424ae1baf3
SHA1

35068cd79a368496ff016e9744f5bfc5b46243a4
SHA256

fa409a4ec066822a97f2e0b0e47a7f4ce9ea3d60025047252511719856cbbd4b
SHA512

d02ff43ad01b2c7d8247efe13a2015c908e4e90b710580c1ef5fe15ac016703c14c20dbcbc62c68567f0656aea00f4d421da40e0f86d6ce17ae867fe73d81277
SSDEEP

49152:LRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBL:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4476 netsh.exe

pid	process
4476	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\auqnigrw\ImagePath = "C:\\Windows\\SysWOW64\\auqnigrw\\pyniutak.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

5068 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

pyniutak.exe

pid process

4484 pyniutak.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

pyniutak.exe

description pid process target process

PID 4484 set thread context of 5068 4484 pyniutak.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1376 sc.exe
1344 sc.exe
3100 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5020 3456 WerFault.exe fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe
4776 4484 WerFault.exe pyniutak.exe

pid	process
5068	svchost.exe

pid	process
4484	pyniutak.exe

description	pid	process	target process
PID 4484 set thread context of 5068	4484	pyniutak.exe	svchost.exe

pid	process
1376	sc.exe
1344	sc.exe
3100	sc.exe

pid	pid_target	process	target process
5020	3456	WerFault.exe	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe
4776	4484	WerFault.exe	pyniutak.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exepyniutak.exe

description	pid	process	target process
PID 3456 wrote to memory of 2192	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 2192	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 2192	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 3636	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 3636	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 3636	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	cmd.exe
PID 3456 wrote to memory of 1376	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 1376	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 1376	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 1344	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 1344	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 1344	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 3100	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 3100	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 3100	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	sc.exe
PID 3456 wrote to memory of 4476	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	netsh.exe
PID 3456 wrote to memory of 4476	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	netsh.exe
PID 3456 wrote to memory of 4476	3456	fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe	netsh.exe
PID 4484 wrote to memory of 5068	4484	pyniutak.exe	svchost.exe
PID 4484 wrote to memory of 5068	4484	pyniutak.exe	svchost.exe
PID 4484 wrote to memory of 5068	4484	pyniutak.exe	svchost.exe
PID 4484 wrote to memory of 5068	4484	pyniutak.exe	svchost.exe
PID 4484 wrote to memory of 5068	4484	pyniutak.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\auqnigrw\
2⤵
PID:2192

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pyniutak.exe" C:\Windows\SysWOW64\auqnigrw\
2⤵
PID:3636

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create auqnigrw binPath= "C:\Windows\SysWOW64\auqnigrw\pyniutak.exe /d\"C:\Users\Admin\AppData\Local\Temp\fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1376

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description auqnigrw "wifi internet conection"
2⤵
- Launches sc.exe
PID:1344

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start auqnigrw
2⤵
- Launches sc.exe
PID:3100

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 892
2⤵
- Program crash
PID:5020

C:\Windows\SysWOW64\auqnigrw\pyniutak.exe
C:\Windows\SysWOW64\auqnigrw\pyniutak.exe /d"C:\Users\Admin\AppData\Local\Temp\fb3e27d3a1c7970ab760ce424ae1baf3_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4484

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 512
2⤵
- Program crash
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3456 -ip 3456
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4484 -ip 4484
1⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:8
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pyniutak.exe

Filesize
10.8MB

MD5
5864ab38a798ad82f56c489fc9250508

SHA1
36654bbcd99a23208bd05849094cce2660d49b85

SHA256
64ebbff5b114f374a5ea408f1970dad3b57de201a00eab43eacf0c6637984698

SHA512
9aaa11aee25e1a4cb06c2ee32970c33476f27ad1729e76404d252a8453d8de870eec90dc00fafe7b35646467be31a3e0a4686b4a2c93dcc938d1d3a80ba479a4

Download Submit
memory/3456-19-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/3456-3-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/3456-5-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/3456-2-0x0000000000F70000-0x0000000000F83000-memory.dmp

Filesize
76KB

Download
memory/3456-10-0x0000000000FD0000-0x00000000010D0000-memory.dmp

Filesize
1024KB

Download
memory/3456-1-0x0000000000FD0000-0x00000000010D0000-memory.dmp

Filesize
1024KB

Download
memory/4484-18-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/4484-12-0x00000000013D0000-0x00000000013E3000-memory.dmp

Filesize
76KB

Download
memory/4484-13-0x0000000000400000-0x0000000000C0A000-memory.dmp

Filesize
8.0MB

Download
memory/4484-11-0x0000000000D30000-0x0000000000E30000-memory.dmp

Filesize
1024KB

Download
memory/5068-14-0x0000000000FB0000-0x0000000000FC5000-memory.dmp

Filesize
84KB

Download
memory/5068-17-0x0000000000FB0000-0x0000000000FC5000-memory.dmp

Filesize
84KB

Download
memory/5068-20-0x0000000000FB0000-0x0000000000FC5000-memory.dmp

Filesize
84KB

Download
memory/5068-21-0x0000000000FB0000-0x0000000000FC5000-memory.dmp

Filesize
84KB

Download
memory/5068-22-0x0000000000FB0000-0x0000000000FC5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads