tofsee | 61faf46dbe077a07465febbc75383ef44bd810b56c6bec95ce046ad8b17c2b2c

General

Target

fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe
Size

14.4MB
MD5

fceccbd5e8f1030c0e3085e771b63177
SHA1

2deda90288dc154d67917e6d4329f853431a2bd8
SHA256

61faf46dbe077a07465febbc75383ef44bd810b56c6bec95ce046ad8b17c2b2c
SHA512

d83449d58ace9c7bd8650c409c82df47a706562f7f7bd4ce0709f471a5d38ffbe0ff428bba7dd137bcd0824bf067c1f102ad2e4fa124984d06b324143b0dd3b1
SSDEEP

49152:ujrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrj:A

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\gqvkikaw = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2456 netsh.exe

pid	process
2456	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gqvkikaw\ImagePath = "C:\\Windows\\SysWOW64\\gqvkikaw\\svddbzdm.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2804 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

svddbzdm.exe

pid process

2820 svddbzdm.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

svddbzdm.exe

description pid process target process

PID 2820 set thread context of 2804 2820 svddbzdm.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2856 sc.exe
2572 sc.exe
2652 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2804	svchost.exe

pid	process
2820	svddbzdm.exe

description	pid	process	target process
PID 2820 set thread context of 2804	2820	svddbzdm.exe	svchost.exe

pid	process
2856	sc.exe
2572	sc.exe
2652	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exesvddbzdm.exe

description	pid	process	target process
PID 1960 wrote to memory of 2516	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2516	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2516	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2516	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2928	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2928	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2928	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2928	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 1960 wrote to memory of 2856	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2856	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2856	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2856	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2572	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2572	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2572	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2572	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2652	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2652	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2652	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 1960 wrote to memory of 2652	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2820 wrote to memory of 2804	2820	svddbzdm.exe	svchost.exe
PID 2820 wrote to memory of 2804	2820	svddbzdm.exe	svchost.exe
PID 2820 wrote to memory of 2804	2820	svddbzdm.exe	svchost.exe
PID 2820 wrote to memory of 2804	2820	svddbzdm.exe	svchost.exe
PID 2820 wrote to memory of 2804	2820	svddbzdm.exe	svchost.exe
PID 2820 wrote to memory of 2804	2820	svddbzdm.exe	svchost.exe
PID 1960 wrote to memory of 2456	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe
PID 1960 wrote to memory of 2456	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe
PID 1960 wrote to memory of 2456	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe
PID 1960 wrote to memory of 2456	1960	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gqvkikaw\
2⤵
PID:2516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\svddbzdm.exe" C:\Windows\SysWOW64\gqvkikaw\
2⤵
PID:2928

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create gqvkikaw binPath= "C:\Windows\SysWOW64\gqvkikaw\svddbzdm.exe /d\"C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2856

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description gqvkikaw "wifi internet conection"
2⤵
- Launches sc.exe
PID:2572

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start gqvkikaw
2⤵
- Launches sc.exe
PID:2652

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2456

C:\Windows\SysWOW64\gqvkikaw\svddbzdm.exe
C:\Windows\SysWOW64\gqvkikaw\svddbzdm.exe /d"C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svddbzdm.exe
Filesize
13.2MB

MD5
a73f964fe0e55422e6883be02be99f96

SHA1
4ed106514da04eed8d237f98a5f11c67ca35a799

SHA256
f1eb1a8e6ef274bf267effa443cc499db7103b52b7c2b9421ea94575e2157c4a

SHA512
1cf3ed6598be5e6e956e75ac60b288e084ba3def40a694c119dd1473d2252f59a4ee46abf235559de5847583a1280ffe283ce5c7a097651b940d981c79c99e16

Download Submit
memory/1960-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1960-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1960-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1960-1-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1960-17-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2804-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2804-12-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2804-9-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2804-16-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2804-18-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2804-19-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2804-20-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2820-13-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2820-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads