tofsee | ffcb451deb32cc683c714d294ee2323c9de49a73372e7a219899baceb19caa2c

General

Target

fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe
Size

14.7MB
MD5

fb75967066a59d021930025b7eab3a8e
SHA1

b3c4760f0bec28df1e09f0c87728a84f704f8ea9
SHA256

ffcb451deb32cc683c714d294ee2323c9de49a73372e7a219899baceb19caa2c
SHA512

75f6875dc1c2b5d1ac368cc9f35ddd82840147550c1ec2d61b36c544782e0dc778d0237b3996319a0fc892fddb35817e8fa9b46b2ac3cd22e409ddee351f9f0d
SSDEEP

6144:zngjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV5:8iOE+Nj4Q50k0UGIh+dJ

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ofeudxqh = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2740 netsh.exe

pid	process
2740	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ofeudxqh\ImagePath = "C:\\Windows\\SysWOW64\\ofeudxqh\\rhcoiuyq.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2828 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

rhcoiuyq.exe

pid process

2460 rhcoiuyq.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rhcoiuyq.exe

description pid process target process

PID 2460 set thread context of 2828 2460 rhcoiuyq.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2664 sc.exe
2652 sc.exe
2868 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2828	svchost.exe

pid	process
2460	rhcoiuyq.exe

description	pid	process	target process
PID 2460 set thread context of 2828	2460	rhcoiuyq.exe	svchost.exe

pid	process
2664	sc.exe
2652	sc.exe
2868	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exerhcoiuyq.exe

description	pid	process	target process
PID 2976 wrote to memory of 2536	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2536	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2536	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2536	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2128	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2128	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2128	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2128	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	cmd.exe
PID 2976 wrote to memory of 2664	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2664	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2664	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2664	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2652	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2652	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2652	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2652	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2868	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2868	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2868	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2868	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	sc.exe
PID 2976 wrote to memory of 2740	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	netsh.exe
PID 2976 wrote to memory of 2740	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	netsh.exe
PID 2976 wrote to memory of 2740	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	netsh.exe
PID 2976 wrote to memory of 2740	2976	fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe	netsh.exe
PID 2460 wrote to memory of 2828	2460	rhcoiuyq.exe	svchost.exe
PID 2460 wrote to memory of 2828	2460	rhcoiuyq.exe	svchost.exe
PID 2460 wrote to memory of 2828	2460	rhcoiuyq.exe	svchost.exe
PID 2460 wrote to memory of 2828	2460	rhcoiuyq.exe	svchost.exe
PID 2460 wrote to memory of 2828	2460	rhcoiuyq.exe	svchost.exe
PID 2460 wrote to memory of 2828	2460	rhcoiuyq.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ofeudxqh\
2⤵
PID:2536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rhcoiuyq.exe" C:\Windows\SysWOW64\ofeudxqh\
2⤵
PID:2128

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create ofeudxqh binPath= "C:\Windows\SysWOW64\ofeudxqh\rhcoiuyq.exe /d\"C:\Users\Admin\AppData\Local\Temp\fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2664

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description ofeudxqh "wifi internet conection"
2⤵
- Launches sc.exe
PID:2652

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ofeudxqh
2⤵
- Launches sc.exe
PID:2868

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2740

C:\Windows\SysWOW64\ofeudxqh\rhcoiuyq.exe
C:\Windows\SysWOW64\ofeudxqh\rhcoiuyq.exe /d"C:\Users\Admin\AppData\Local\Temp\fb75967066a59d021930025b7eab3a8e_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rhcoiuyq.exe

Filesize
11.3MB

MD5
c2cb1de382104c90ebaf868fe5d7ed5a

SHA1
f0bb28aa2c8cbbde1326c1d6f9a08401743bb290

SHA256
233eab842fa5dc23ec9ccd28bec1914c55de49fd6a4278162800424b262aae87

SHA512
c13fc2440f49e9346a758e9417559802941c39d89ea1d58affa7dfac814bd894b03a8e439ce70fd2078ac8ff3ba7349c876dec1cfb28d5293bb90fdf3792162d

Download Submit
memory/2460-10-0x0000000000400000-0x0000000001782000-memory.dmp

Filesize
19.5MB

Download
memory/2460-9-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2460-17-0x0000000000400000-0x0000000001782000-memory.dmp

Filesize
19.5MB

Download
memory/2828-14-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2828-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2828-11-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2828-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2828-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2828-21-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2976-4-0x0000000000400000-0x0000000001782000-memory.dmp

Filesize
19.5MB

Download
memory/2976-1-0x0000000001870000-0x0000000001970000-memory.dmp

Filesize
1024KB

Download
memory/2976-8-0x0000000000400000-0x0000000001782000-memory.dmp

Filesize
19.5MB

Download
memory/2976-3-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads