tofsee | 1e2a56bfb27bbdef81f7fb668e42e104e0ac2503ee75710e0a057cec0c6df76e

General

Target

88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe
Size

142KB
MD5

88c17f3f1763b8423d393baba1e9b4c7
SHA1

c11443fcf1f4571548045b4b607dc28a8d0e01b8
SHA256

1e2a56bfb27bbdef81f7fb668e42e104e0ac2503ee75710e0a057cec0c6df76e
SHA512

81e61204ed87245c027097a948398675d0a42de3789fa0424046885fd87dcacfcff852163e215f2b9ac83578c3ad47f896363d0d843f1bef17a9b2051a998203
SSDEEP

3072:ClHB+LO7fIsSSoJvnra4BcwfMq/eTW8q7k9f:h6foJDDBcwt/vS

Score

10^/10

tofsee evasion execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\rywoxdno = "0"	svchost.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2580 netsh.exe

pid	process
2580	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rywoxdno\ImagePath = "C:\\Windows\\SysWOW64\\rywoxdno\\rthiwegq.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2600 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

rthiwegq.exe

pid process

2792 rthiwegq.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

rthiwegq.exe

description pid process target process

PID 2792 set thread context of 2600 2792 rthiwegq.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2796 sc.exe
2708 sc.exe
2588 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2600	svchost.exe

pid	process
2792	rthiwegq.exe

description	pid	process	target process
PID 2792 set thread context of 2600	2792	rthiwegq.exe	svchost.exe

pid	process
2796	sc.exe
2708	sc.exe
2588	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exerthiwegq.exe

description	pid	process	target process
PID 2940 wrote to memory of 3048	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 3048	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 3048	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 3048	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 2652	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 2652	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 2652	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 2652	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	cmd.exe
PID 2940 wrote to memory of 2796	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2796	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2796	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2796	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2708	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2708	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2708	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2708	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2588	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2588	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2588	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2588	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	sc.exe
PID 2940 wrote to memory of 2580	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	netsh.exe
PID 2940 wrote to memory of 2580	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	netsh.exe
PID 2940 wrote to memory of 2580	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	netsh.exe
PID 2940 wrote to memory of 2580	2940	88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe	netsh.exe
PID 2792 wrote to memory of 2600	2792	rthiwegq.exe	svchost.exe
PID 2792 wrote to memory of 2600	2792	rthiwegq.exe	svchost.exe
PID 2792 wrote to memory of 2600	2792	rthiwegq.exe	svchost.exe
PID 2792 wrote to memory of 2600	2792	rthiwegq.exe	svchost.exe
PID 2792 wrote to memory of 2600	2792	rthiwegq.exe	svchost.exe
PID 2792 wrote to memory of 2600	2792	rthiwegq.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rywoxdno\
  2⤵
  PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rthiwegq.exe" C:\Windows\SysWOW64\rywoxdno\
  2⤵
  PID:2652
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create rywoxdno binPath= "C:\Windows\SysWOW64\rywoxdno\rthiwegq.exe /d\"C:\Users\Admin\AppData\Local\Temp\88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2796
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description rywoxdno "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2708
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start rywoxdno
  2⤵
  - Launches sc.exe
  PID:2588
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:2580

C:\Windows\SysWOW64\rywoxdno\rthiwegq.exe
C:\Windows\SysWOW64\rywoxdno\rthiwegq.exe /d"C:\Users\Admin\AppData\Local\Temp\88c17f3f1763b8423d393baba1e9b4c7_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rthiwegq.exe

Filesize
11.7MB

MD5
0018a3b8edbfdeb50800c9ba8fb6eebb

SHA1
bdc40a33e32f4bff6c976ab7276232ceca3f349f

SHA256
3690c4c6a4a4ce6f63f4db75ba4b444680e1ee407a0cf1583d5f6b9ea65bdddd

SHA512
5373e2d5c4e7dad13771b866605d81a8bdc723da217f974805322c2da9a6dfa8d6b5b66080bc346d8f1684b8e057aa81fa28fd6d286a22119df212406b7a55f7

Download Submit
memory/2600-8-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2600-11-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2600-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-13-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2600-15-0x00000000000C0000-0x00000000000D5000-memory.dmp

Filesize
84KB

Download
memory/2792-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2792-14-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2940-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2940-2-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2940-1-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2940-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads