tofsee | 8268704a7d561c3b77519503ac645bee86e62991cb3844bc90e12515d468afcd

General

Target

041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe
Size

98KB
MD5

041f1786762e19b8f29423a19ca0498c
SHA1

5ccb39b1480d9c693b429f35b0f7f3e5afb0730e
SHA256

8268704a7d561c3b77519503ac645bee86e62991cb3844bc90e12515d468afcd
SHA512

41b565b4e981fca822f9c95ea65ef1da13386a199612609d94a4056cc04824abf03e70bdc5e7869ebd47dfc1ed36f5eda40dd665070b9b557e35cd07b726c6ec
SSDEEP

1536:2u7R8+GeLxCi1s95kG0tTZaNxas1Y29db/vIHduOfpkwMEkR:2u7RBtlHs9z0PSxJ1T1/vIAEyLEs

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1208 netsh.exe

pid	process
1208	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zhqjuddo\ImagePath = "C:\\Windows\\SysWOW64\\zhqjuddo\\anbegger.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1404 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

anbegger.exe

pid process

3488 anbegger.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

anbegger.exe

description pid process target process

PID 3488 set thread context of 1404 3488 anbegger.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3352 sc.exe
1276 sc.exe
632 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1404	svchost.exe

pid	process
3488	anbegger.exe

description	pid	process	target process
PID 3488 set thread context of 1404	3488	anbegger.exe	svchost.exe

pid	process
3352	sc.exe
1276	sc.exe
632	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exeanbegger.exe

description	pid	process	target process
PID 3060 wrote to memory of 1060	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	cmd.exe
PID 3060 wrote to memory of 1060	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	cmd.exe
PID 3060 wrote to memory of 1060	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	cmd.exe
PID 3060 wrote to memory of 2788	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	cmd.exe
PID 3060 wrote to memory of 2788	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	cmd.exe
PID 3060 wrote to memory of 2788	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	cmd.exe
PID 3060 wrote to memory of 3352	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 3352	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 3352	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 1276	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 1276	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 1276	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 632	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 632	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3060 wrote to memory of 632	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	sc.exe
PID 3488 wrote to memory of 1404	3488	anbegger.exe	svchost.exe
PID 3488 wrote to memory of 1404	3488	anbegger.exe	svchost.exe
PID 3488 wrote to memory of 1404	3488	anbegger.exe	svchost.exe
PID 3488 wrote to memory of 1404	3488	anbegger.exe	svchost.exe
PID 3488 wrote to memory of 1404	3488	anbegger.exe	svchost.exe
PID 3060 wrote to memory of 1208	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	netsh.exe
PID 3060 wrote to memory of 1208	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	netsh.exe
PID 3060 wrote to memory of 1208	3060	041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zhqjuddo\
2⤵
PID:1060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\anbegger.exe" C:\Windows\SysWOW64\zhqjuddo\
2⤵
PID:2788

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create zhqjuddo binPath= "C:\Windows\SysWOW64\zhqjuddo\anbegger.exe /d\"C:\Users\Admin\AppData\Local\Temp\041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:3352

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description zhqjuddo "wifi internet conection"
2⤵
- Launches sc.exe
PID:1276

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start zhqjuddo
2⤵
- Launches sc.exe
PID:632

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:1208

C:\Windows\SysWOW64\zhqjuddo\anbegger.exe
C:\Windows\SysWOW64\zhqjuddo\anbegger.exe /d"C:\Users\Admin\AppData\Local\Temp\041f1786762e19b8f29423a19ca0498c_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\anbegger.exe

Filesize
14.6MB

MD5
11bc85d729b69d0a20ce5a5113fa4241

SHA1
533b9fa3a15afda8c23d4992e558de1f922be381

SHA256
4843ceb06fbcc16e25d1de1fba95a23b617a8e3ec7edd63ef52400785baa5401

SHA512
27649cf2be099a14303ea2df68dea0ff85e58dd87a3dd15f21ce424bdadf1accde86c646971d3337d294cd1d4bbdd2eed52b5eac809b7b93c379a69705096bbb

Download Submit
memory/1404-8-0x00000000008B0000-0x00000000008C5000-memory.dmp

Filesize
84KB

Download
memory/1404-11-0x00000000008B0000-0x00000000008C5000-memory.dmp

Filesize
84KB

Download
memory/1404-14-0x00000000008B0000-0x00000000008C5000-memory.dmp

Filesize
84KB

Download
memory/1404-15-0x00000000008B0000-0x00000000008C5000-memory.dmp

Filesize
84KB

Download
memory/1404-16-0x00000000008B0000-0x00000000008C5000-memory.dmp

Filesize
84KB

Download
memory/3060-2-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/3060-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3060-1-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/3060-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3488-6-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/3488-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3488-12-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads