tofsee | ad93fa58692bf500dc7f4a54513d87f0cceeaf9a955bc3d366abd2e2bbcaeedb

Analysis

max time kernel
157s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb53a3645626f491923c495997330c8d_JaffaCakes118.exe
Size 14.8MB
Sample240419-2m2c3shd88
SHA256 ad93fa58692bf500dc7f4a54513d87f0cceeaf9a955bc3d366abd2e2bbcaeedb
MD5 fb53a3645626f491923c495997330c8d
SHA1 da6c44e90b85ea788c4076b7ed67d1b02213ccfe
SHA512 311e78a1740839ff21a31f1082d881ce31157c11767b901bef6232b9afd34e7fe18d93badf8f54d65ef4ec1d64dcfdf7ec6cc9f1ee25429fe9c51342b0926a37
SSDEEP 24576:PjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee+:P/D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1900	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aoeqgzqz\ImagePath = "C:\\Windows\\SysWOW64\\aoeqgzqz\\oxnbcqfl.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
468	oxnbcqfl.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 1372	468	oxnbcqfl.exe	105

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1100	sc.exe
708	sc.exe
4988	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4444	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	90
PID 3800 wrote to memory of 4444	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	90
PID 3800 wrote to memory of 4444	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	90
PID 3800 wrote to memory of 4016	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	92
PID 3800 wrote to memory of 4016	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	92
PID 3800 wrote to memory of 4016	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	92
PID 3800 wrote to memory of 1100	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	95
PID 3800 wrote to memory of 1100	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	95
PID 3800 wrote to memory of 1100	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	95
PID 3800 wrote to memory of 708	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	98
PID 3800 wrote to memory of 708	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	98
PID 3800 wrote to memory of 708	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	98
PID 3800 wrote to memory of 4988	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	100
PID 3800 wrote to memory of 4988	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	100
PID 3800 wrote to memory of 4988	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	100
PID 3800 wrote to memory of 1900	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	102
PID 3800 wrote to memory of 1900	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	102
PID 3800 wrote to memory of 1900	3800	fb53a3645626f491923c495997330c8d_JaffaCakes118.exe	102
PID 468 wrote to memory of 1372	468	oxnbcqfl.exe	105
PID 468 wrote to memory of 1372	468	oxnbcqfl.exe	105
PID 468 wrote to memory of 1372	468	oxnbcqfl.exe	105
PID 468 wrote to memory of 1372	468	oxnbcqfl.exe	105
PID 468 wrote to memory of 1372	468	oxnbcqfl.exe	105

C:\Users\Admin\AppData\Local\Temp\fb53a3645626f491923c495997330c8d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb53a3645626f491923c495997330c8d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\aoeqgzqz\
  2⤵
  PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oxnbcqfl.exe" C:\Windows\SysWOW64\aoeqgzqz\
  2⤵
  PID:4016
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create aoeqgzqz binPath= "C:\Windows\SysWOW64\aoeqgzqz\oxnbcqfl.exe /d\"C:\Users\Admin\AppData\Local\Temp\fb53a3645626f491923c495997330c8d_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:1100
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description aoeqgzqz "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:708
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start aoeqgzqz
  2⤵
  - Launches sc.exe
  PID:4988
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1900

C:\Windows\SysWOW64\aoeqgzqz\oxnbcqfl.exe
C:\Windows\SysWOW64\aoeqgzqz\oxnbcqfl.exe /d"C:\Users\Admin\AppData\Local\Temp\fb53a3645626f491923c495997330c8d_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oxnbcqfl.exe

Path C:\Users\Admin\AppData\Local\Temp\oxnbcqfl.exe
Size 13.7MB
SHA256 d41439ee16bcb6955bbf7e46d64e2872e921913c853af6d96f2c2cc2bc0b8b67
MD5 606335d96f346cdbde96472aecaf4f61
SHA1 65b0c6867ef24b431673c10ea5e0c0f5ee2771d2
SHA512 5900dadce96207ba4523459ebadda7eb4ae7c57915d0bc83d3a8d5d73edd8939d499bbaa343186c4dcacf6a3307b8790046f597e8977be2e0f6a2beadb06f803
SSDEEP 24576:6jCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeW:6/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/468-13-0x0000000000770000-0x0000000000870000-memory.dmp

Download

memory/468-14-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/468-19-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/1372-15-0x00000000010C0000-0x00000000010D5000-memory.dmp

Download

memory/1372-29-0x00000000010C0000-0x00000000010D5000-memory.dmp

Download

memory/1372-21-0x00000000010C0000-0x00000000010D5000-memory.dmp

Download

memory/1372-20-0x00000000010C0000-0x00000000010D5000-memory.dmp

Download

memory/1372-18-0x00000000010C0000-0x00000000010D5000-memory.dmp

Download

memory/3800-10-0x0000000000600000-0x0000000000700000-memory.dmp

Download

memory/3800-12-0x00000000021B0000-0x00000000021C3000-memory.dmp

Download

memory/3800-1-0x0000000000600000-0x0000000000700000-memory.dmp

Download

memory/3800-3-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3800-11-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/3800-2-0x00000000021B0000-0x00000000021C3000-memory.dmp

Download

memory/3800-5-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads