tofsee | ba9da660fce6bc22eae29f80bacde100bbcaa748c675e68bcfaa04ccaaf2f20b

General

Target

b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe
Size

120KB
MD5

b2ff3c3152615f2ebb1b04f4f1912e3d
SHA1

811d816320a6bfcc6198db38bb0d6176b6d73460
SHA256

ba9da660fce6bc22eae29f80bacde100bbcaa748c675e68bcfaa04ccaaf2f20b
SHA512

f500c49b05ecea5be31ef9e31e0295812c68ab066d9410b24ab9d6fdce94ab00b2248b50bf7fde1fff529b3ed01cd25ea906fb1ec508ffbc4e128736280b3a3d
SSDEEP

1536:GCt2rSASlezj33Yh/2haLYmOlxmvOmxdXWXixGE9bz+rXzJ3Jft1VGV:ySAgowga2DmvOOdXWGDl+TzJ3htXG

Score

10^/10

tofsee evasion execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Windows security bypass 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qoywlac = "0"	svchost.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1804 netsh.exe

pid	process
1804	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\qoywlac\ImagePath = "C:\\Windows\\SysWOW64\\qoywlac\\fwpszmyx.exe"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

2668 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

fwpszmyx.exe

pid process

1876 fwpszmyx.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

fwpszmyx.exe

description pid process target process

PID 1876 set thread context of 2668 1876 fwpszmyx.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2744 sc.exe
2576 sc.exe
2808 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2668	svchost.exe

pid	process
1876	fwpszmyx.exe

description	pid	process	target process
PID 1876 set thread context of 2668	1876	fwpszmyx.exe	svchost.exe

pid	process
2744	sc.exe
2576	sc.exe
2808	sc.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exefwpszmyx.exe

description	pid	process	target process
PID 920 wrote to memory of 2552	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2552	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2552	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2552	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2344	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2344	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2344	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2344	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	cmd.exe
PID 920 wrote to memory of 2744	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2744	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2744	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2744	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2576	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2576	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2576	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2576	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2808	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2808	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2808	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 920 wrote to memory of 2808	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	sc.exe
PID 1876 wrote to memory of 2668	1876	fwpszmyx.exe	svchost.exe
PID 1876 wrote to memory of 2668	1876	fwpszmyx.exe	svchost.exe
PID 1876 wrote to memory of 2668	1876	fwpszmyx.exe	svchost.exe
PID 1876 wrote to memory of 2668	1876	fwpszmyx.exe	svchost.exe
PID 1876 wrote to memory of 2668	1876	fwpszmyx.exe	svchost.exe
PID 1876 wrote to memory of 2668	1876	fwpszmyx.exe	svchost.exe
PID 920 wrote to memory of 1804	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	netsh.exe
PID 920 wrote to memory of 1804	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	netsh.exe
PID 920 wrote to memory of 1804	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	netsh.exe
PID 920 wrote to memory of 1804	920	b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qoywlac\
  2⤵
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fwpszmyx.exe" C:\Windows\SysWOW64\qoywlac\
  2⤵
  PID:2344
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create qoywlac binPath= "C:\Windows\SysWOW64\qoywlac\fwpszmyx.exe /d\"C:\Users\Admin\AppData\Local\Temp\b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  PID:2744
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description qoywlac "wifi internet conection"
  2⤵
  - Launches sc.exe
  PID:2576
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start qoywlac
  2⤵
  - Launches sc.exe
  PID:2808
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  PID:1804

C:\Windows\SysWOW64\qoywlac\fwpszmyx.exe
C:\Windows\SysWOW64\qoywlac\fwpszmyx.exe /d"C:\Users\Admin\AppData\Local\Temp\b2ff3c3152615f2ebb1b04f4f1912e3d_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Windows security bypass
  - Sets service image path in registry
  - Deletes itself
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify System Firewall

1

T1562.004

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fwpszmyx.exe

Filesize
10.6MB

MD5
984dfd6f63e188a63020cf2c264fd0d0

SHA1
e1c486a1c376757d7ad3d02ad65064e8924ec2c9

SHA256
9d1a8e65a27c1cd9b1849001bfb196be07183e9b9264ce29fc371cd58be9ff8d

SHA512
4aed9435613f28a304276280caebabdc9a6e2490cc9fa56a8ca049e687881677d131074922d61b6ddf8bdaf5995def3388b88f686cf621fc0e85cc4a27f5f0e8

Download Submit
memory/920-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/920-1-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/920-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/920-15-0x00000000050E0000-0x00000000050F1000-memory.dmp

Filesize
68KB

Download
memory/920-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1876-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1876-6-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1876-12-0x00000000050E0000-0x00000000050F1000-memory.dmp

Filesize
68KB

Download
memory/2668-7-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2668-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-10-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2668-16-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download
memory/2668-17-0x0000000000080000-0x0000000000095000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads