tofsee | 075c3400a03685ae454d633c12c68fdb1908ee2383fa95a5dfc72421b4c8666e

General

Target

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
Size

136KB
MD5

05bf320994954329a3fd404d0d82fa62
SHA1

7f46b22586acb7ea85bac546df8535864290febf
SHA256

075c3400a03685ae454d633c12c68fdb1908ee2383fa95a5dfc72421b4c8666e
SHA512

b355fe1d63696920dc548b9b3d616e7b7415a48d73bf1f49a460051af125ec51f2c0ee705926618aaf6cc40c7a2f2c0db8665b97bd083429ede28969f8436d46
SSDEEP

3072:YAzWS96CT5+8KRNlw5eXRS0uvB+bIJXo4y:jzV9JTM8K+5eY0u5+uXxy

Score

10^/10

tofsee persistence trojan

Malware Config

Extracted

Family

tofsee

C2

94.75.255.140

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

Processes:

agx.exeagx.exe

pid process

2260 agx.exe
3776 agx.exe

pid	process
2260	agx.exe
3776	agx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\agx.exe\" /r"	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exeagx.exeagx.exe

description	pid	process	target process
PID 2172 set thread context of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2260 set thread context of 3776	2260	agx.exe	agx.exe
PID 3776 set thread context of 2076	3776	agx.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2796 2076 WerFault.exe svchost.exe

pid	pid_target	process	target process
2796	2076	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exeagx.exeagx.exe

description	pid	process	target process
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 2172 wrote to memory of 3588	2172	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
PID 3588 wrote to memory of 2260	3588	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	agx.exe
PID 3588 wrote to memory of 2260	3588	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	agx.exe
PID 3588 wrote to memory of 2260	3588	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 2260 wrote to memory of 3776	2260	agx.exe	agx.exe
PID 3776 wrote to memory of 2076	3776	agx.exe	svchost.exe
PID 3776 wrote to memory of 2076	3776	agx.exe	svchost.exe
PID 3776 wrote to memory of 2076	3776	agx.exe	svchost.exe
PID 3776 wrote to memory of 2076	3776	agx.exe	svchost.exe
PID 3776 wrote to memory of 2076	3776	agx.exe	svchost.exe
PID 3588 wrote to memory of 4736	3588	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe
PID 3588 wrote to memory of 4736	3588	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe
PID 3588 wrote to memory of 4736	3588	05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05bf320994954329a3fd404d0d82fa62_JaffaCakes118.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3588

C:\Users\Admin\agx.exe
"C:\Users\Admin\agx.exe" /r
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2260

C:\Users\Admin\agx.exe
"C:\Users\Admin\agx.exe" /r
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\svchost.exe
svchost.exe
5⤵
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 200
6⤵
- Program crash
PID:2796

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5826.bat" "
3⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2076 -ip 2076
1⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3828,i,16866810346450717340,3849854439116899380,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:8
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5826.bat
Filesize
117B

MD5
1899dbe4750663bff9531d9f7b4e84d6

SHA1
55ff4fc30994e4b3a3aa4719a1d70a1dca57a7cd

SHA256
5ef113218af9d46b95687e948b6e442627500b96c0add3cb1f347d5469291800

SHA512
c5424d9b027cb6e3f458eb0c40695faee88a5c8e4b8988d8469461b18d4440c659f319181a8f3f16b5238ef6820afad5bda518e0091b344eb6bd350f57b7ec5a

Download Submit
C:\Users\Admin\agx.exe
Filesize
136KB

MD5
05bf320994954329a3fd404d0d82fa62

SHA1
7f46b22586acb7ea85bac546df8535864290febf

SHA256
075c3400a03685ae454d633c12c68fdb1908ee2383fa95a5dfc72421b4c8666e

SHA512
b355fe1d63696920dc548b9b3d616e7b7415a48d73bf1f49a460051af125ec51f2c0ee705926618aaf6cc40c7a2f2c0db8665b97bd083429ede28969f8436d46

Download Submit
memory/2076-14-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/2076-20-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/2076-28-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/2076-29-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/2076-30-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/2076-31-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/3588-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3588-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3588-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3776-13-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads