tofsee | d9871688f45307444ebd7f8df6009abd6533db193d8eb334bb375c42e45ba366

General

Target

03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe
Size

14.4MB
MD5

03193e7ffb478a21a97774a8eceee490
SHA1

9be4d7d83d855b49595e94c30b393e4a8f16a759
SHA256

d9871688f45307444ebd7f8df6009abd6533db193d8eb334bb375c42e45ba366
SHA512

457639d643f94b3190020c7e5f7149b1c69b4b2b486f57106722506071c29feb3b29d509a294e5c6d1603a7ed5de82c46f824c31a1a6d58aff274faaa7e6a4cd
SSDEEP

196608:7E/vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvH:7E

Score

10^/10

tofsee evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3892 netsh.exe

pid	process
3892	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\spfnhxvp\ImagePath = "C:\\Windows\\SysWOW64\\spfnhxvp\\kaaapgme.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

5028 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

kaaapgme.exe

pid process

4580 kaaapgme.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

kaaapgme.exe

description pid process target process

PID 4580 set thread context of 5028 4580 kaaapgme.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

4208 sc.exe
2568 sc.exe
3572 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5028	svchost.exe

pid	process
4580	kaaapgme.exe

description	pid	process	target process
PID 4580 set thread context of 5028	4580	kaaapgme.exe	svchost.exe

pid	process
4208	sc.exe
2568	sc.exe
3572	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2556 1916 WerFault.exe 03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe
4372 4580 WerFault.exe kaaapgme.exe

pid	pid_target	process	target process
2556	1916	WerFault.exe	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe
4372	4580	WerFault.exe	kaaapgme.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exekaaapgme.exe

description	pid	process	target process
PID 1916 wrote to memory of 208	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	cmd.exe
PID 1916 wrote to memory of 208	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	cmd.exe
PID 1916 wrote to memory of 208	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	cmd.exe
PID 1916 wrote to memory of 1268	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	cmd.exe
PID 1916 wrote to memory of 1268	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	cmd.exe
PID 1916 wrote to memory of 1268	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	cmd.exe
PID 1916 wrote to memory of 4208	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 4208	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 4208	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 2568	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 2568	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 2568	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 3572	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 3572	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 3572	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	sc.exe
PID 1916 wrote to memory of 3892	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	netsh.exe
PID 1916 wrote to memory of 3892	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	netsh.exe
PID 1916 wrote to memory of 3892	1916	03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe	netsh.exe
PID 4580 wrote to memory of 5028	4580	kaaapgme.exe	svchost.exe
PID 4580 wrote to memory of 5028	4580	kaaapgme.exe	svchost.exe
PID 4580 wrote to memory of 5028	4580	kaaapgme.exe	svchost.exe
PID 4580 wrote to memory of 5028	4580	kaaapgme.exe	svchost.exe
PID 4580 wrote to memory of 5028	4580	kaaapgme.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\spfnhxvp\
2⤵
PID:208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kaaapgme.exe" C:\Windows\SysWOW64\spfnhxvp\
2⤵
PID:1268

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create spfnhxvp binPath= "C:\Windows\SysWOW64\spfnhxvp\kaaapgme.exe /d\"C:\Users\Admin\AppData\Local\Temp\03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:4208

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description spfnhxvp "wifi internet conection"
2⤵
- Launches sc.exe
PID:2568

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start spfnhxvp
2⤵
- Launches sc.exe
PID:3572

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 1036
2⤵
- Program crash
PID:2556

C:\Windows\SysWOW64\spfnhxvp\kaaapgme.exe
C:\Windows\SysWOW64\spfnhxvp\kaaapgme.exe /d"C:\Users\Admin\AppData\Local\Temp\03193e7ffb478a21a97774a8eceee490_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 508
2⤵
- Program crash
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1916 -ip 1916
1⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4580 -ip 4580
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kaaapgme.exe

Filesize
11.5MB

MD5
db27c4dc015cab0295a3b2e27443644b

SHA1
edf87afb044289252a7a25d48c8eb51c825748ed

SHA256
000ae471d6f8a5c0467de77e4e08c52a1a4456c3ab9f6a99bccb47f47f503e0a

SHA512
abcfd327788cb0f802c73193bebce2f7666db30630957a3280f8261bc0b2590e6cddd5dd6a94c414d9375fde75b94a332484d2a5f55db0bb00782c1733fd2cb6

Download Submit
memory/1916-8-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/1916-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1916-1-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/1916-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1916-9-0x00000000001D0000-0x00000000001E3000-memory.dmp

Filesize
76KB

Download
memory/1916-2-0x00000000001D0000-0x00000000001E3000-memory.dmp

Filesize
76KB

Download
memory/4580-11-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/4580-16-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/4580-14-0x0000000000400000-0x0000000000870000-memory.dmp

Filesize
4.4MB

Download
memory/5028-15-0x0000000000CB0000-0x0000000000CC5000-memory.dmp

Filesize
84KB

Download
memory/5028-17-0x0000000000CB0000-0x0000000000CC5000-memory.dmp

Filesize
84KB

Download
memory/5028-12-0x0000000000CB0000-0x0000000000CC5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads