tofsee | 307644b1154391b4f425896da8efd9480fb3dda0f56c633b08c32058f5b469fa

General

Target

ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe
Size

10.1MB
MD5

ff3556fcc81946e1a83ab271568bbd36
SHA1

2e74da5aec95c19c0521f80b0d019058c5fa2fad
SHA256

307644b1154391b4f425896da8efd9480fb3dda0f56c633b08c32058f5b469fa
SHA512

c4c583736516d16ef249169af8668dde9e7e06cc534538c68e594bd68ca284784f5c766db8cb796669362bf1816e58d1790b38ffe757cf0a08ed4bb69d890eb6
SSDEEP

98304:qC+PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP/:p

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xykpfvqt = "0"	svchost.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2964 netsh.exe

pid	process
2964	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xykpfvqt\ImagePath = "C:\\Windows\\SysWOW64\\xykpfvqt\\cakiiyhx.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2676 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

cakiiyhx.exe

pid process

2668 cakiiyhx.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

cakiiyhx.exe

description pid process target process

PID 2668 set thread context of 2676 2668 cakiiyhx.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2568 sc.exe
2648 sc.exe
2580 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2676	svchost.exe

pid	process
2668	cakiiyhx.exe

description	pid	process	target process
PID 2668 set thread context of 2676	2668	cakiiyhx.exe	svchost.exe

pid	process
2568	sc.exe
2648	sc.exe
2580	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.execakiiyhx.exe

description	pid	process	target process
PID 2224 wrote to memory of 2904	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2904	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2904	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2904	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2516	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2516	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2516	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2516	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	cmd.exe
PID 2224 wrote to memory of 2568	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2568	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2568	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2568	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2648	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2648	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2648	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2648	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2580	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2580	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2580	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2580	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	sc.exe
PID 2224 wrote to memory of 2964	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	netsh.exe
PID 2224 wrote to memory of 2964	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	netsh.exe
PID 2224 wrote to memory of 2964	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	netsh.exe
PID 2224 wrote to memory of 2964	2224	ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe	netsh.exe
PID 2668 wrote to memory of 2676	2668	cakiiyhx.exe	svchost.exe
PID 2668 wrote to memory of 2676	2668	cakiiyhx.exe	svchost.exe
PID 2668 wrote to memory of 2676	2668	cakiiyhx.exe	svchost.exe
PID 2668 wrote to memory of 2676	2668	cakiiyhx.exe	svchost.exe
PID 2668 wrote to memory of 2676	2668	cakiiyhx.exe	svchost.exe
PID 2668 wrote to memory of 2676	2668	cakiiyhx.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xykpfvqt\
2⤵
PID:2904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cakiiyhx.exe" C:\Windows\SysWOW64\xykpfvqt\
2⤵
PID:2516

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create xykpfvqt binPath= "C:\Windows\SysWOW64\xykpfvqt\cakiiyhx.exe /d\"C:\Users\Admin\AppData\Local\Temp\ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2568

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description xykpfvqt "wifi internet conection"
2⤵
- Launches sc.exe
PID:2648

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start xykpfvqt
2⤵
- Launches sc.exe
PID:2580

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:2964

C:\Windows\SysWOW64\xykpfvqt\cakiiyhx.exe
C:\Windows\SysWOW64\xykpfvqt\cakiiyhx.exe /d"C:\Users\Admin\AppData\Local\Temp\ff3556fcc81946e1a83ab271568bbd36_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cakiiyhx.exe
Filesize
10.5MB

MD5
409e3f067579b7472a902d3748fb70d4

SHA1
ed52ffb4929ce9e9da9911537deec5286303fcef

SHA256
c5ac7496b4e52536df59be8c0a88b7e9b01ebe09ae88572e8cea84ae1213d176

SHA512
873043411b27bf911318cf4d3c62d561110cbb907e68d9cdf708b6d7938993d486414916b202cd3ae2da323b6c031fa3896456a82ed7c9e550ff0a2e60b1d8d7

Download Submit
memory/2224-1-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2224-2-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2224-3-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2224-9-0x0000000000220000-0x0000000000233000-memory.dmp

Filesize
76KB

Download
memory/2224-8-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2668-10-0x00000000002D0000-0x00000000003D0000-memory.dmp

Filesize
1024KB

Download
memory/2668-11-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2668-16-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2676-12-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2676-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2676-15-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2676-19-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2676-20-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download
memory/2676-21-0x00000000000D0000-0x00000000000E5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads