tofsee | c0aea4faca6ebef23d42c4daa61585c835aaa69cb819a29bf67b03881469bf04

General

Target

fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe
Size

13.6MB
MD5

fa05c055fc43c8c597197b590670ca85
SHA1

8b4e076dd4f300a82a21e255e14413737b575b4c
SHA256

c0aea4faca6ebef23d42c4daa61585c835aaa69cb819a29bf67b03881469bf04
SHA512

1455a615d3a8b3b0d50350da785784baf830f3b3b10cabaa19c7d97a112a3334fbcc0e5a0883b3fa77135f1f173185a83c44f7d113f82b21000e9fa6ca090798
SSDEEP

49152:KR88888888888888888888888888888888888888888888888888888888888884:

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vgiqqlsj = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2556 netsh.exe

pid	process
2556	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vgiqqlsj\ImagePath = "C:\\Windows\\SysWOW64\\vgiqqlsj\\scxsjjci.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2244 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

scxsjjci.exe

pid process

2660 scxsjjci.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

scxsjjci.exe

description pid process target process

PID 2660 set thread context of 2244 2660 scxsjjci.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2636 sc.exe
3052 sc.exe
2604 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2244	svchost.exe

pid	process
2660	scxsjjci.exe

description	pid	process	target process
PID 2660 set thread context of 2244	2660	scxsjjci.exe	svchost.exe

pid	process
2636	sc.exe
3052	sc.exe
2604	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exescxsjjci.exe

description	pid	process	target process
PID 2320 wrote to memory of 2032	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2032	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2032	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2032	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2160	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2160	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2160	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2160	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	cmd.exe
PID 2320 wrote to memory of 2636	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2636	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2636	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2636	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 3052	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 3052	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 3052	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 3052	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2604	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2604	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2604	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2604	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	sc.exe
PID 2320 wrote to memory of 2556	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	netsh.exe
PID 2320 wrote to memory of 2556	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	netsh.exe
PID 2320 wrote to memory of 2556	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	netsh.exe
PID 2320 wrote to memory of 2556	2320	fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe	netsh.exe
PID 2660 wrote to memory of 2244	2660	scxsjjci.exe	svchost.exe
PID 2660 wrote to memory of 2244	2660	scxsjjci.exe	svchost.exe
PID 2660 wrote to memory of 2244	2660	scxsjjci.exe	svchost.exe
PID 2660 wrote to memory of 2244	2660	scxsjjci.exe	svchost.exe
PID 2660 wrote to memory of 2244	2660	scxsjjci.exe	svchost.exe
PID 2660 wrote to memory of 2244	2660	scxsjjci.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vgiqqlsj\
  2⤵
  PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\scxsjjci.exe" C:\Windows\SysWOW64\vgiqqlsj\
  2⤵
  PID:2160
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create vgiqqlsj binPath= "C:\Windows\SysWOW64\vgiqqlsj\scxsjjci.exe /d\"C:\Users\Admin\AppData\Local\Temp\fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2636
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description vgiqqlsj "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:3052
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start vgiqqlsj
  2⤵
  - Launches sc.exe
  PID:2604
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2556

C:\Windows\SysWOW64\vgiqqlsj\scxsjjci.exe
C:\Windows\SysWOW64\vgiqqlsj\scxsjjci.exe /d"C:\Users\Admin\AppData\Local\Temp\fa05c055fc43c8c597197b590670ca85_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\scxsjjci.exe

Filesize
10.6MB

MD5
c36ec26c5474695a5f826fc2fe7b9fb3

SHA1
be454983772e85508cb70d27d671f399e599d1a3

SHA256
c20ef833ecf8a221731d3f57f3fca5f52af84fb52952d0af02f1bdfbed2edad0

SHA512
af11554a06aa7894d75b412d67c5f74cac9b414a7559f0b8789cb5972b648fd285223177be626f5553e490364673214b2d00ec41ca628898dd03c79bc17e0e24

Download Submit
memory/2244-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2244-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2244-13-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2244-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2244-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2244-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2320-4-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download
memory/2320-3-0x00000000003C0000-0x00000000003D3000-memory.dmp

Filesize
76KB

Download
memory/2320-7-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download
memory/2320-1-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2660-10-0x00000000033E0000-0x00000000034E0000-memory.dmp

Filesize
1024KB

Download
memory/2660-15-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download
memory/2660-16-0x0000000000400000-0x000000000323C000-memory.dmp

Filesize
46.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads