tofsee | fe63f09d06765b954959e9d86d9d9f550c7e4c2c5e6fb07bc53be0c61bc7f417

General

Target

fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe
Size

13.6MB
MD5

fc8689f0eceff18d958eb59b7d2c31fc
SHA1

1bf9746ab6de03b237e9610f26e018db2bdaa0aa
SHA256

fe63f09d06765b954959e9d86d9d9f550c7e4c2c5e6fb07bc53be0c61bc7f417
SHA512

7dbdd25fd84529eed80cc3bbb7db416c8ee45c068be591cc07076cbfd06565717e343415f75871a6cf96d62992176274938f09cb27e522203d24337f01fb5fb1
SSDEEP

196608:+Lad4qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqv:+L

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

412 netsh.exe

pid	process
412	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ribpgzqh\ImagePath = "C:\\Windows\\SysWOW64\\ribpgzqh\\dkwjsfga.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

884 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

dkwjsfga.exe

pid process

808 dkwjsfga.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

dkwjsfga.exe

description pid process target process

PID 808 set thread context of 884 808 dkwjsfga.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2660 sc.exe
5036 sc.exe
3808 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4332 220 WerFault.exe fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe
5108 808 WerFault.exe dkwjsfga.exe

pid	process
884	svchost.exe

pid	process
808	dkwjsfga.exe

description	pid	process	target process
PID 808 set thread context of 884	808	dkwjsfga.exe	svchost.exe

pid	process
2660	sc.exe
5036	sc.exe
3808	sc.exe

pid	pid_target	process	target process
4332	220	WerFault.exe	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe
5108	808	WerFault.exe	dkwjsfga.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exedkwjsfga.exe

description	pid	process	target process
PID 220 wrote to memory of 4664	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	cmd.exe
PID 220 wrote to memory of 4664	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	cmd.exe
PID 220 wrote to memory of 4664	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	cmd.exe
PID 220 wrote to memory of 3012	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	cmd.exe
PID 220 wrote to memory of 3012	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	cmd.exe
PID 220 wrote to memory of 3012	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	cmd.exe
PID 220 wrote to memory of 2660	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 2660	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 2660	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 5036	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 5036	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 5036	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 3808	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 3808	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 3808	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	sc.exe
PID 220 wrote to memory of 412	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	netsh.exe
PID 220 wrote to memory of 412	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	netsh.exe
PID 220 wrote to memory of 412	220	fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe	netsh.exe
PID 808 wrote to memory of 884	808	dkwjsfga.exe	svchost.exe
PID 808 wrote to memory of 884	808	dkwjsfga.exe	svchost.exe
PID 808 wrote to memory of 884	808	dkwjsfga.exe	svchost.exe
PID 808 wrote to memory of 884	808	dkwjsfga.exe	svchost.exe
PID 808 wrote to memory of 884	808	dkwjsfga.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:220

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ribpgzqh\
2⤵
PID:4664

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dkwjsfga.exe" C:\Windows\SysWOW64\ribpgzqh\
2⤵
PID:3012

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create ribpgzqh binPath= "C:\Windows\SysWOW64\ribpgzqh\dkwjsfga.exe /d\"C:\Users\Admin\AppData\Local\Temp\fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2660

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description ribpgzqh "wifi internet conection"
2⤵
- Launches sc.exe
PID:5036

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ribpgzqh
2⤵
- Launches sc.exe
PID:3808

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 664
2⤵
- Program crash
PID:4332

C:\Windows\SysWOW64\ribpgzqh\dkwjsfga.exe
C:\Windows\SysWOW64\ribpgzqh\dkwjsfga.exe /d"C:\Users\Admin\AppData\Local\Temp\fc8689f0eceff18d958eb59b7d2c31fc_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 520
2⤵
- Program crash
PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 220 -ip 220
1⤵
PID:552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 808 -ip 808
1⤵
PID:4140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dkwjsfga.exe
Filesize
12.0MB

MD5
fa7c6161052a1f948ae77285e7bf45ed

SHA1
366b0ba9f8fb650ff2b6e69b288037c4d2d12118

SHA256
cda2e2bc07f9772d45f63b77f0b0d1754b8a10fa1420b68afb10a8b71f9b8e50

SHA512
66c062616dd3df436c4829ad48771b782c688066dcee9c73446d1e326efe13d4da7a253a01b8904bfd6b2fc08a782b607b843542a91175df5ec68e9b51df9ae8

Download Submit
memory/220-1-0x0000000000B60000-0x0000000000C60000-memory.dmp

Filesize
1024KB

Download
memory/220-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

Filesize
76KB

Download
memory/220-4-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/220-8-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/220-9-0x00000000001E0000-0x00000000001F3000-memory.dmp

Filesize
76KB

Download
memory/808-10-0x0000000000A60000-0x0000000000B60000-memory.dmp

Filesize
1024KB

Download
memory/808-13-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/808-18-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/884-15-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download
memory/884-11-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download
memory/884-16-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download
memory/884-17-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download
memory/884-19-0x00000000003A0000-0x00000000003B5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads