tofsee | 075c3400a03685ae454d633c12c68fdb1908ee2383fa95a5dfc72421b4c8666e

General

Target

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
Size

136KB
MD5

05bf320994954329a3fd404d0d82fa62
SHA1

7f46b22586acb7ea85bac546df8535864290febf
SHA256

075c3400a03685ae454d633c12c68fdb1908ee2383fa95a5dfc72421b4c8666e
SHA512

b355fe1d63696920dc548b9b3d616e7b7415a48d73bf1f49a460051af125ec51f2c0ee705926618aaf6cc40c7a2f2c0db8665b97bd083429ede28969f8436d46
SSDEEP

3072:YAzWS96CT5+8KRNlw5eXRS0uvB+bIJXo4y:jzV9JTM8K+5eY0u5+uXxy

Score

10^/10

tofsee persistence trojan

Malware Config

Extracted

Family

tofsee

C2

94.75.255.140

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2408 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

itf.exeitf.exe

pid process

2700 itf.exe
2132 itf.exe
Loads dropped DLL 3 IoCs

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exeitf.exe

pid process

2204 05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
2204 05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
2700 itf.exe

pid	process
2408	cmd.exe

pid	process
2700	itf.exe
2132	itf.exe

pid	process
2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
2700	itf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\itf.exe\" /r"	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exeitf.exeitf.exe

description	pid	process	target process
PID 2176 set thread context of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2700 set thread context of 2132	2700	itf.exe	itf.exe
PID 2132 set thread context of 2668	2132	itf.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exeitf.exeitf.exe

description	pid	process	target process
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2176 wrote to memory of 2204	2176	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2204 wrote to memory of 2700	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	itf.exe
PID 2204 wrote to memory of 2700	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	itf.exe
PID 2204 wrote to memory of 2700	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	itf.exe
PID 2204 wrote to memory of 2700	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2700 wrote to memory of 2132	2700	itf.exe	itf.exe
PID 2132 wrote to memory of 2668	2132	itf.exe	svchost.exe
PID 2132 wrote to memory of 2668	2132	itf.exe	svchost.exe
PID 2132 wrote to memory of 2668	2132	itf.exe	svchost.exe
PID 2132 wrote to memory of 2668	2132	itf.exe	svchost.exe
PID 2132 wrote to memory of 2668	2132	itf.exe	svchost.exe
PID 2132 wrote to memory of 2668	2132	itf.exe	svchost.exe
PID 2204 wrote to memory of 2408	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe
PID 2204 wrote to memory of 2408	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe
PID 2204 wrote to memory of 2408	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe
PID 2204 wrote to memory of 2408	2204	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2176

C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\itf.exe
"C:\Users\Admin\itf.exe" /r
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\itf.exe
"C:\Users\Admin\itf.exe" /r
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\svchost.exe
svchost.exe
5⤵
PID:2668

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\1305.bat" "
3⤵
- Deletes itself
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1305.bat
Filesize
117B

MD5
1899dbe4750663bff9531d9f7b4e84d6

SHA1
55ff4fc30994e4b3a3aa4719a1d70a1dca57a7cd

SHA256
5ef113218af9d46b95687e948b6e442627500b96c0add3cb1f347d5469291800

SHA512
c5424d9b027cb6e3f458eb0c40695faee88a5c8e4b8988d8469461b18d4440c659f319181a8f3f16b5238ef6820afad5bda518e0091b344eb6bd350f57b7ec5a

Download Submit
\Users\Admin\itf.exe
Filesize
136KB

MD5
05bf320994954329a3fd404d0d82fa62

SHA1
7f46b22586acb7ea85bac546df8535864290febf

SHA256
075c3400a03685ae454d633c12c68fdb1908ee2383fa95a5dfc72421b4c8666e

SHA512
b355fe1d63696920dc548b9b3d616e7b7415a48d73bf1f49a460051af125ec51f2c0ee705926618aaf6cc40c7a2f2c0db8665b97bd083429ede28969f8436d46

Download Submit
memory/2132-45-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-61-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2204-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2668-53-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2668-41-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-58-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2668-42-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2668-63-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads