tofsee | 61faf46dbe077a07465febbc75383ef44bd810b56c6bec95ce046ad8b17c2b2c

General

Target

fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe
Size

14.4MB
MD5

fceccbd5e8f1030c0e3085e771b63177
SHA1

2deda90288dc154d67917e6d4329f853431a2bd8
SHA256

61faf46dbe077a07465febbc75383ef44bd810b56c6bec95ce046ad8b17c2b2c
SHA512

d83449d58ace9c7bd8650c409c82df47a706562f7f7bd4ce0709f471a5d38ffbe0ff428bba7dd137bcd0824bf067c1f102ad2e4fa124984d06b324143b0dd3b1
SSDEEP

49152:ujrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrj:A

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1916 netsh.exe

pid	process
1916	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vdkvebmo\ImagePath = "C:\\Windows\\SysWOW64\\vdkvebmo\\knvvtrve.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

5028 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

knvvtrve.exe

pid process

432 knvvtrve.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

knvvtrve.exe

description pid process target process

PID 432 set thread context of 5028 432 knvvtrve.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

384 sc.exe
3316 sc.exe
4120 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5028	svchost.exe

pid	process
432	knvvtrve.exe

description	pid	process	target process
PID 432 set thread context of 5028	432	knvvtrve.exe	svchost.exe

pid	process
384	sc.exe
3316	sc.exe
4120	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exeknvvtrve.exe

description	pid	process	target process
PID 2300 wrote to memory of 2476	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 2476	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 2476	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 5068	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 5068	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 5068	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	cmd.exe
PID 2300 wrote to memory of 384	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 384	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 384	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3316	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3316	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 3316	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 4120	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 4120	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 2300 wrote to memory of 4120	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	sc.exe
PID 432 wrote to memory of 5028	432	knvvtrve.exe	svchost.exe
PID 432 wrote to memory of 5028	432	knvvtrve.exe	svchost.exe
PID 432 wrote to memory of 5028	432	knvvtrve.exe	svchost.exe
PID 432 wrote to memory of 5028	432	knvvtrve.exe	svchost.exe
PID 432 wrote to memory of 5028	432	knvvtrve.exe	svchost.exe
PID 2300 wrote to memory of 1916	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe
PID 2300 wrote to memory of 1916	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe
PID 2300 wrote to memory of 1916	2300	fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vdkvebmo\
2⤵
PID:2476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\knvvtrve.exe" C:\Windows\SysWOW64\vdkvebmo\
2⤵
PID:5068

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create vdkvebmo binPath= "C:\Windows\SysWOW64\vdkvebmo\knvvtrve.exe /d\"C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:384

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description vdkvebmo "wifi internet conection"
2⤵
- Launches sc.exe
PID:3316

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start vdkvebmo
2⤵
- Launches sc.exe
PID:4120

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1916

C:\Windows\SysWOW64\vdkvebmo\knvvtrve.exe
C:\Windows\SysWOW64\vdkvebmo\knvvtrve.exe /d"C:\Users\Admin\AppData\Local\Temp\fceccbd5e8f1030c0e3085e771b63177_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\knvvtrve.exe

Filesize
13.3MB

MD5
05e03c9627c49cc23bee26e4b2b0a472

SHA1
567bc74c31ea3e4169d32dbef2803ae9e46ad5ea

SHA256
c522b436504f4857e84c2cfbb93f62200afb721f15e0658491bd1c639e572da3

SHA512
5015f3869c2ddb8303ef0d918e9cfb4ab93b576fc7873dfc1eb5afac63dfc2f4256976fef948bbbede88c808052728991f8a7f2416252df36e9759279ef68e01

Download Submit
memory/432-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/432-8-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Filesize
4KB

Download
memory/432-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2300-3-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/2300-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2300-1-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2300-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2300-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5028-10-0x00000000012C0000-0x00000000012D5000-memory.dmp

Filesize
84KB

Download
memory/5028-14-0x00000000012C0000-0x00000000012D5000-memory.dmp

Filesize
84KB

Download
memory/5028-16-0x00000000012C0000-0x00000000012D5000-memory.dmp

Filesize
84KB

Download
memory/5028-17-0x00000000012C0000-0x00000000012D5000-memory.dmp

Filesize
84KB

Download
memory/5028-18-0x00000000012C0000-0x00000000012D5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads