tofsee | fe784fd541b07359345cdfb43b8065e2bc998174db60cf3a17f8346db36490c8

General

Target

fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe
Size

12.8MB
MD5

fc36b1375b31d55e67f16990365d95ff
SHA1

4957b074548b93c0eeb22fbc2566b0fa08816d76
SHA256

fe784fd541b07359345cdfb43b8065e2bc998174db60cf3a17f8346db36490c8
SHA512

b9d2c225d480098889360bef9a892ca97593e27b32304399392af23cc72c6f31d34d7c1c131444e9eb0ebdc0dfb64d4834a0aac1cd0802787b01934dc9209165
SSDEEP

49152:NFUk///////////////////////////////////////////////////////////n:NF

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1440 netsh.exe

pid	process
1440	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frsnusre\ImagePath = "C:\\Windows\\SysWOW64\\frsnusre\\jwifylqa.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2140 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

jwifylqa.exe

pid process

2716 jwifylqa.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

jwifylqa.exe

description pid process target process

PID 2716 set thread context of 2140 2716 jwifylqa.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

5008 sc.exe
3760 sc.exe
4528 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4256 4812 WerFault.exe fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe
2548 2716 WerFault.exe jwifylqa.exe

pid	process
2140	svchost.exe

pid	process
2716	jwifylqa.exe

description	pid	process	target process
PID 2716 set thread context of 2140	2716	jwifylqa.exe	svchost.exe

pid	process
5008	sc.exe
3760	sc.exe
4528	sc.exe

pid	pid_target	process	target process
4256	4812	WerFault.exe	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe
2548	2716	WerFault.exe	jwifylqa.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exejwifylqa.exe

description	pid	process	target process
PID 4812 wrote to memory of 4560	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	cmd.exe
PID 4812 wrote to memory of 4560	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	cmd.exe
PID 4812 wrote to memory of 4560	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	cmd.exe
PID 4812 wrote to memory of 2156	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	cmd.exe
PID 4812 wrote to memory of 2156	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	cmd.exe
PID 4812 wrote to memory of 2156	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	cmd.exe
PID 4812 wrote to memory of 5008	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 5008	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 5008	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 3760	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 3760	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 3760	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 4528	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 4528	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 4528	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	sc.exe
PID 4812 wrote to memory of 1440	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	netsh.exe
PID 4812 wrote to memory of 1440	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	netsh.exe
PID 4812 wrote to memory of 1440	4812	fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe	netsh.exe
PID 2716 wrote to memory of 2140	2716	jwifylqa.exe	svchost.exe
PID 2716 wrote to memory of 2140	2716	jwifylqa.exe	svchost.exe
PID 2716 wrote to memory of 2140	2716	jwifylqa.exe	svchost.exe
PID 2716 wrote to memory of 2140	2716	jwifylqa.exe	svchost.exe
PID 2716 wrote to memory of 2140	2716	jwifylqa.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4812

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\frsnusre\
2⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jwifylqa.exe" C:\Windows\SysWOW64\frsnusre\
2⤵
PID:2156

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create frsnusre binPath= "C:\Windows\SysWOW64\frsnusre\jwifylqa.exe /d\"C:\Users\Admin\AppData\Local\Temp\fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:5008

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description frsnusre "wifi internet conection"
2⤵
- Launches sc.exe
PID:3760

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start frsnusre
2⤵
- Launches sc.exe
PID:4528

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1316
2⤵
- Program crash
PID:4256

C:\Windows\SysWOW64\frsnusre\jwifylqa.exe
C:\Windows\SysWOW64\frsnusre\jwifylqa.exe /d"C:\Users\Admin\AppData\Local\Temp\fc36b1375b31d55e67f16990365d95ff_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 540
2⤵
- Program crash
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4812 -ip 4812
1⤵
PID:4056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2716 -ip 2716
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jwifylqa.exe

Filesize
13.0MB

MD5
e97b47f0361b31328c7e8c0361aab3ef

SHA1
1e1bb045288923d6762244cc0e91b9e9fe31778c

SHA256
72291b6cd3fd3133c6cfdec1586ef84a036be45af721bf386a081c4ea751ebc6

SHA512
52f579d6e44bbb5073458dff13bd1aa10b186d5acaffd612eff875a60fca42f9bc1c6d3e79f96582d3ceb7a3c79ed004e80300fb5bcb60ce583f16025af987a7

Download Submit
memory/2140-15-0x0000000001290000-0x00000000012A5000-memory.dmp

Filesize
84KB

Download
memory/2140-12-0x0000000001290000-0x00000000012A5000-memory.dmp

Filesize
84KB

Download
memory/2140-16-0x0000000001290000-0x00000000012A5000-memory.dmp

Filesize
84KB

Download
memory/2140-18-0x0000000001290000-0x00000000012A5000-memory.dmp

Filesize
84KB

Download
memory/2140-19-0x0000000001290000-0x00000000012A5000-memory.dmp

Filesize
84KB

Download
memory/2716-10-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/2716-11-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/2716-17-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4812-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4812-2-0x0000000000600000-0x0000000000613000-memory.dmp

Filesize
76KB

Download
memory/4812-7-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4812-8-0x0000000000600000-0x0000000000613000-memory.dmp

Filesize
76KB

Download
memory/4812-1-0x0000000000680000-0x0000000000780000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads