tofsee | 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59

General

Target

5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe
Size

142KB
MD5

5e40852b1b836ae50ea61b4dc56124e9
SHA1

b01babd89da56da58ae26ea756bfe6dbdbc917d5
SHA256

2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59
SHA512

7e57324bafde20171129bd0a873654cece5827e93a00423bf98a89612343cd483fd67556dedaa72c5ae92f2a603c9dfab880881d986722d1403c508b523bc276
SSDEEP

3072:MO8/FLfgM6rzTkYfiL2+jKfgi4m5nuGFU6W6WN06b3U:I9GzwFLnKP46uC

Score

10^/10

tofsee evasion execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4564 netsh.exe

pid	process
4564	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\upfwssst\ImagePath = "C:\\Windows\\SysWOW64\\upfwssst\\wjzitgtn.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1920 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

wjzitgtn.exe

pid process

4492 wjzitgtn.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

wjzitgtn.exe

description pid process target process

PID 4492 set thread context of 1920 4492 wjzitgtn.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1956 sc.exe
4828 sc.exe
1672 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1920	svchost.exe

pid	process
4492	wjzitgtn.exe

description	pid	process	target process
PID 4492 set thread context of 1920	4492	wjzitgtn.exe	svchost.exe

pid	process
1956	sc.exe
4828	sc.exe
1672	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exewjzitgtn.exe

description	pid	process	target process
PID 1076 wrote to memory of 4000	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	cmd.exe
PID 1076 wrote to memory of 4000	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	cmd.exe
PID 1076 wrote to memory of 4000	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	cmd.exe
PID 1076 wrote to memory of 2192	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	cmd.exe
PID 1076 wrote to memory of 2192	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	cmd.exe
PID 1076 wrote to memory of 2192	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	cmd.exe
PID 1076 wrote to memory of 1956	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 1956	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 1956	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 4828	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 4828	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 4828	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 1672	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 1672	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 1672	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	sc.exe
PID 1076 wrote to memory of 4564	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	netsh.exe
PID 1076 wrote to memory of 4564	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	netsh.exe
PID 1076 wrote to memory of 4564	1076	5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe	netsh.exe
PID 4492 wrote to memory of 1920	4492	wjzitgtn.exe	svchost.exe
PID 4492 wrote to memory of 1920	4492	wjzitgtn.exe	svchost.exe
PID 4492 wrote to memory of 1920	4492	wjzitgtn.exe	svchost.exe
PID 4492 wrote to memory of 1920	4492	wjzitgtn.exe	svchost.exe
PID 4492 wrote to memory of 1920	4492	wjzitgtn.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\upfwssst\
2⤵
PID:4000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wjzitgtn.exe" C:\Windows\SysWOW64\upfwssst\
2⤵
PID:2192

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create upfwssst binPath= "C:\Windows\SysWOW64\upfwssst\wjzitgtn.exe /d\"C:\Users\Admin\AppData\Local\Temp\5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1956

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description upfwssst "wifi internet conection"
2⤵
- Launches sc.exe
PID:4828

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start upfwssst
2⤵
- Launches sc.exe
PID:1672

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4564

C:\Windows\SysWOW64\upfwssst\wjzitgtn.exe
C:\Windows\SysWOW64\upfwssst\wjzitgtn.exe /d"C:\Users\Admin\AppData\Local\Temp\5e40852b1b836ae50ea61b4dc56124e9_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4492

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:1920

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wjzitgtn.exe
Filesize
10.5MB

MD5
63f389712683989037fae1f89923b469

SHA1
30aeebdad15477a91d93912583809ce6cd3513a0

SHA256
e8fedc5ac7a6ebdb7dbcb6bf7fc26015e3c7fff2d95fa8ed85477bb5d2e6adf5

SHA512
a24805f3dc43a944935593c8c0a0812fda96406b6901acc1a7e22204256028f93f2da364497599b4e4ae38cd38c6adffb5bb477f3548bbb1c7aef97a07c00f79

Download Submit
memory/1076-0-0x0000000000580000-0x0000000000581000-memory.dmp

Filesize
4KB

Download
memory/1076-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1076-2-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/1076-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1920-9-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/1920-11-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/1920-13-0x0000000000AC0000-0x0000000000AD5000-memory.dmp

Filesize
84KB

Download
memory/4492-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4492-8-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/4492-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads