tofsee | f2b1f77c8f3cc3817b73566c28f88827acdb1b48ea8985072817e97b59c5f7ac

General

Target

fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe
Size

11.3MB
MD5

fccc85e0762350fc26fd50646031b5f6
SHA1

9e6636fffc2002b023b246e5c08ff641002ef232
SHA256

f2b1f77c8f3cc3817b73566c28f88827acdb1b48ea8985072817e97b59c5f7ac
SHA512

d4ef35eb8a365f6333565652fd1ddba2d8fd71050cc47860a7eb6ec36eec5a35c9cd9f3a7f48f379b5edbeb9e32883a326267062d67cdb22ec76366d6a319678
SSDEEP

24576:iUqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmG:iF15

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\zyrbeyvr = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2736 netsh.exe

pid	process
2736	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\zyrbeyvr\ImagePath = "C:\\Windows\\SysWOW64\\zyrbeyvr\\xgomfhkk.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2696 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

xgomfhkk.exe

pid process

2744 xgomfhkk.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

xgomfhkk.exe

description pid process target process

PID 2744 set thread context of 2696 2744 xgomfhkk.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2596 sc.exe
2680 sc.exe
2576 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2696	svchost.exe

pid	process
2744	xgomfhkk.exe

description	pid	process	target process
PID 2744 set thread context of 2696	2744	xgomfhkk.exe	svchost.exe

pid	process
2596	sc.exe
2680	sc.exe
2576	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exexgomfhkk.exe

description	pid	process	target process
PID 2380 wrote to memory of 1756	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 1756	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 1756	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 1756	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 2556	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 2556	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 2556	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 2556	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	cmd.exe
PID 2380 wrote to memory of 2596	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2596	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2596	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2596	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2680	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2680	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2680	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2680	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2576	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2576	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2576	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2576	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	sc.exe
PID 2380 wrote to memory of 2736	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	netsh.exe
PID 2380 wrote to memory of 2736	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	netsh.exe
PID 2380 wrote to memory of 2736	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	netsh.exe
PID 2380 wrote to memory of 2736	2380	fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe	netsh.exe
PID 2744 wrote to memory of 2696	2744	xgomfhkk.exe	svchost.exe
PID 2744 wrote to memory of 2696	2744	xgomfhkk.exe	svchost.exe
PID 2744 wrote to memory of 2696	2744	xgomfhkk.exe	svchost.exe
PID 2744 wrote to memory of 2696	2744	xgomfhkk.exe	svchost.exe
PID 2744 wrote to memory of 2696	2744	xgomfhkk.exe	svchost.exe
PID 2744 wrote to memory of 2696	2744	xgomfhkk.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zyrbeyvr\
2⤵
PID:1756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\xgomfhkk.exe" C:\Windows\SysWOW64\zyrbeyvr\
2⤵
PID:2556

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create zyrbeyvr binPath= "C:\Windows\SysWOW64\zyrbeyvr\xgomfhkk.exe /d\"C:\Users\Admin\AppData\Local\Temp\fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2596

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description zyrbeyvr "wifi internet conection"
2⤵
- Launches sc.exe
PID:2680

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start zyrbeyvr
2⤵
- Launches sc.exe
PID:2576

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2736

C:\Windows\SysWOW64\zyrbeyvr\xgomfhkk.exe
C:\Windows\SysWOW64\zyrbeyvr\xgomfhkk.exe /d"C:\Users\Admin\AppData\Local\Temp\fccc85e0762350fc26fd50646031b5f6_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\xgomfhkk.exe
Filesize
14.3MB

MD5
ede7ab6b0f48b8c5fb7f84d3a1b15837

SHA1
6b8c768c4448a281c8703297d505f1cb89dbb2c8

SHA256
b6f4d4173883f0555157713cb33e2549ce696ffa48f42803c541fe45bf743976

SHA512
099d32a9008101fc33e6eb3e7e77612543dd9a12d2131f6fec7b6eb353ad22dcd91c9ac051c7b11eead6223a850353fc958a30707fba4aa6b3d75395db8884cf

Download Submit
memory/2380-1-0x00000000002B0000-0x00000000003B0000-memory.dmp

Filesize
1024KB

Download
memory/2380-4-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2380-8-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2380-3-0x00000000001B0000-0x00000000001C3000-memory.dmp

Filesize
76KB

Download
memory/2696-18-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2696-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2696-20-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2696-14-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2696-19-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2696-9-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2744-11-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2744-16-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/2744-10-0x0000000000500000-0x0000000000600000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads