tofsee | 40ddfa5e9adf75169f553482db151abecf58134e1b80f2681f9528e85fb204c3

General

Target

91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe
Size

142KB
MD5

91e150cf143714919e8f076e28ffa0af
SHA1

9f77919f92363378b6910acec411b1d4b8fce86b
SHA256

40ddfa5e9adf75169f553482db151abecf58134e1b80f2681f9528e85fb204c3
SHA512

9aad4f50d92d14914d872852939f75c903f892b9ab0d761ee6f4bcea92ca7109b411b2564562b80a876b90de2a92370c3ccc85874939e24b2a281828f4cdad8a
SSDEEP

3072:PO8/FLfgq6rzTkYfiL2+jKfgi4m5nuGFU6W6WNU6b37:N94zwFLnKP46uC

Score

10^/10

tofsee evasion execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4328 netsh.exe

pid	process
4328	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ypbhsktp\ImagePath = "C:\\Windows\\SysWOW64\\ypbhsktp\\zpthxtow.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

3720 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

zpthxtow.exe

pid process

1628 zpthxtow.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

zpthxtow.exe

description pid process target process

PID 1628 set thread context of 3720 1628 zpthxtow.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2252 sc.exe
4536 sc.exe
3628 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3720	svchost.exe

pid	process
1628	zpthxtow.exe

description	pid	process	target process
PID 1628 set thread context of 3720	1628	zpthxtow.exe	svchost.exe

pid	process
2252	sc.exe
4536	sc.exe
3628	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exezpthxtow.exe

description	pid	process	target process
PID 644 wrote to memory of 4668	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	cmd.exe
PID 644 wrote to memory of 4668	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	cmd.exe
PID 644 wrote to memory of 4668	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	cmd.exe
PID 644 wrote to memory of 452	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	cmd.exe
PID 644 wrote to memory of 452	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	cmd.exe
PID 644 wrote to memory of 452	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	cmd.exe
PID 644 wrote to memory of 2252	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 2252	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 2252	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 4536	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 4536	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 4536	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 3628	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 3628	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 3628	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	sc.exe
PID 644 wrote to memory of 4328	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	netsh.exe
PID 644 wrote to memory of 4328	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	netsh.exe
PID 644 wrote to memory of 4328	644	91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe	netsh.exe
PID 1628 wrote to memory of 3720	1628	zpthxtow.exe	svchost.exe
PID 1628 wrote to memory of 3720	1628	zpthxtow.exe	svchost.exe
PID 1628 wrote to memory of 3720	1628	zpthxtow.exe	svchost.exe
PID 1628 wrote to memory of 3720	1628	zpthxtow.exe	svchost.exe
PID 1628 wrote to memory of 3720	1628	zpthxtow.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ypbhsktp\
2⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zpthxtow.exe" C:\Windows\SysWOW64\ypbhsktp\
2⤵
PID:452

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create ypbhsktp binPath= "C:\Windows\SysWOW64\ypbhsktp\zpthxtow.exe /d\"C:\Users\Admin\AppData\Local\Temp\91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2252

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description ypbhsktp "wifi internet conection"
2⤵
- Launches sc.exe
PID:4536

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start ypbhsktp
2⤵
- Launches sc.exe
PID:3628

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
PID:4328

C:\Windows\SysWOW64\ypbhsktp\zpthxtow.exe
C:\Windows\SysWOW64\ypbhsktp\zpthxtow.exe /d"C:\Users\Admin\AppData\Local\Temp\91e150cf143714919e8f076e28ffa0af_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:3720

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\zpthxtow.exe
Filesize
12.2MB

MD5
e3f63d82777f923391c5fcc17a3813e8

SHA1
0991aa0dfec5e13392e27b217870d68d7ad29659

SHA256
93a07e00b55b325ec32db197aa50fd7e0573965b043002a58af2fbe9f9b1f314

SHA512
b8c4a7160dfff2db71e2eb3cc3efe2022513812ea159b764b87e0111de5dbc2cfccf644388ba5d02b726cc6dfc8e5082c5d213ee52c44f089aa29634cc55bebf

Download Submit
memory/644-0-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/644-1-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/644-2-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/644-6-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-7-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1628-8-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1628-12-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/3720-9-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download
memory/3720-11-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download
memory/3720-13-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads