tofsee | a6bffcb4a9a7eb5cab0789e497350262ba9ced233acb1ca2d598f756e7e47289

General

Target

fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe
Size

332KB
MD5

fef1dddddde5a01cd2ed74e6c031bd23
SHA1

38a3ed6a45566821ffdb0e13558d0869f4fec077
SHA256

a6bffcb4a9a7eb5cab0789e497350262ba9ced233acb1ca2d598f756e7e47289
SHA512

0711a792ff2824e0e244d7dcf16dc92cf97d34d0c9a56f62f00fbe9e670a11923f7e7c822bdb5a6e73159bd8459a2a115d84140c606acd1e706bd931621db905
SSDEEP

6144:qutIFH/0RO0uydH3+BmV4gOj/Tz707JLEB8yA1muSE9jl+:qutIFfqVdH3+BmOBj/n70Fm8HmPi+

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1432 netsh.exe

pid	process
1432	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fjhzkjfv\ImagePath = "C:\\Windows\\SysWOW64\\fjhzkjfv\\czkpnxur.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2660 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

czkpnxur.exe

pid process

4584 czkpnxur.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

czkpnxur.exe

description pid process target process

PID 4584 set thread context of 2660 4584 czkpnxur.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

216 sc.exe
5000 sc.exe
2160 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2016 4068 WerFault.exe fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe
688 4584 WerFault.exe czkpnxur.exe

pid	process
2660	svchost.exe

pid	process
4584	czkpnxur.exe

description	pid	process	target process
PID 4584 set thread context of 2660	4584	czkpnxur.exe	svchost.exe

pid	process
216	sc.exe
5000	sc.exe
2160	sc.exe

pid	pid_target	process	target process
2016	4068	WerFault.exe	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe
688	4584	WerFault.exe	czkpnxur.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.execzkpnxur.exe

description	pid	process	target process
PID 4068 wrote to memory of 1352	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 1352	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 1352	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 3268	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 3268	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 3268	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	cmd.exe
PID 4068 wrote to memory of 216	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 216	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 216	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 5000	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 5000	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 5000	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 2160	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 2160	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 2160	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	sc.exe
PID 4068 wrote to memory of 1432	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	netsh.exe
PID 4068 wrote to memory of 1432	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	netsh.exe
PID 4068 wrote to memory of 1432	4068	fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe	netsh.exe
PID 4584 wrote to memory of 2660	4584	czkpnxur.exe	svchost.exe
PID 4584 wrote to memory of 2660	4584	czkpnxur.exe	svchost.exe
PID 4584 wrote to memory of 2660	4584	czkpnxur.exe	svchost.exe
PID 4584 wrote to memory of 2660	4584	czkpnxur.exe	svchost.exe
PID 4584 wrote to memory of 2660	4584	czkpnxur.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fjhzkjfv\
2⤵
PID:1352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\czkpnxur.exe" C:\Windows\SysWOW64\fjhzkjfv\
2⤵
PID:3268

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create fjhzkjfv binPath= "C:\Windows\SysWOW64\fjhzkjfv\czkpnxur.exe /d\"C:\Users\Admin\AppData\Local\Temp\fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:216

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description fjhzkjfv "wifi internet conection"
2⤵
- Launches sc.exe
PID:5000

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start fjhzkjfv
2⤵
- Launches sc.exe
PID:2160

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 1264
2⤵
- Program crash
PID:2016

C:\Windows\SysWOW64\fjhzkjfv\czkpnxur.exe
C:\Windows\SysWOW64\fjhzkjfv\czkpnxur.exe /d"C:\Users\Admin\AppData\Local\Temp\fef1dddddde5a01cd2ed74e6c031bd23_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 512
2⤵
- Program crash
PID:688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4068 -ip 4068
1⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4584 -ip 4584
1⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\czkpnxur.exe
Filesize
10.4MB

MD5
ccc5e09cd6025b9fa5572da0b410f1fe

SHA1
0bf0a2d52bf90ff61112265cfc39c3951319f56f

SHA256
03942ab44a22972999e7559ba224a989ddfbd3e772f7a3ef2b5dc8b327a9a944

SHA512
da5b70a79aa9e35f164edcf689ab76397be2f928fc961dc95d6a9c2265d506872ebdabc13f27cae16d9b27c7b56aff36cedbab6ed3c72bb464c6bc8715686f71

Download Submit
memory/2660-13-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/2660-22-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/2660-21-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/2660-20-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/2660-17-0x0000000000110000-0x0000000000125000-memory.dmp

Filesize
84KB

Download
memory/4068-12-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download
memory/4068-1-0x0000000000870000-0x0000000000970000-memory.dmp

Filesize
1024KB

Download
memory/4068-6-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4068-19-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4068-4-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4068-3-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4068-2-0x00000000024E0000-0x00000000024F3000-memory.dmp

Filesize
76KB

Download
memory/4584-11-0x00000000008B0000-0x00000000008C3000-memory.dmp

Filesize
76KB

Download
memory/4584-10-0x00000000008F0000-0x00000000009F0000-memory.dmp

Filesize
1024KB

Download
memory/4584-14-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download
memory/4584-18-0x0000000000400000-0x0000000000785000-memory.dmp

Filesize
3.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads