tofsee | 207acfca1de1938e54d115382a281816e4c0144001010f677234f34c56f67d0e

General

Target

297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
Size

99KB
MD5

297562b2a02789dd03deb8207e9c637f
SHA1

3e8df0c99673b561cb8422111587a628af006dd3
SHA256

207acfca1de1938e54d115382a281816e4c0144001010f677234f34c56f67d0e
SHA512

183c7a25187aa18e6348657e76d5a76f89ed359a61e86a0fc0fa1deb2b27874b35c35db61fa32aca642eeee367d4a8f180175607b4f552502e9fdcef5e9a194e
SSDEEP

1536:sVYd3yhx2UZ22bwA6CP1kqHbDP5XPg4EpweDXIMEQd03rdPxsu4a:sVCH46Ekq7j5XPg490If355Ma

Score

10^/10

tofsee persistence trojan

Malware Config

Extracted

Family

tofsee

C2

64.20.54.234

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2472 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

ltyq.exeltyq.exe

pid process

2968 ltyq.exe
2144 ltyq.exe
Loads dropped DLL 2 IoCs

Processes:

297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exeltyq.exe

pid process

1972 297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
2968 ltyq.exe

pid	process
2472	cmd.exe

pid	process
2968	ltyq.exe
2144	ltyq.exe

pid	process
1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
2968	ltyq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ltyq.exe\" /r"	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exeltyq.exeltyq.exe

description	pid	process	target process
PID 2068 set thread context of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2968 set thread context of 2144	2968	ltyq.exe	ltyq.exe
PID 2144 set thread context of 2120	2144	ltyq.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exeltyq.exeltyq.exe

description	pid	process	target process
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 2068 wrote to memory of 1972	2068	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
PID 1972 wrote to memory of 2968	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	ltyq.exe
PID 1972 wrote to memory of 2968	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	ltyq.exe
PID 1972 wrote to memory of 2968	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	ltyq.exe
PID 1972 wrote to memory of 2968	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2968 wrote to memory of 2144	2968	ltyq.exe	ltyq.exe
PID 2144 wrote to memory of 2120	2144	ltyq.exe	svchost.exe
PID 2144 wrote to memory of 2120	2144	ltyq.exe	svchost.exe
PID 2144 wrote to memory of 2120	2144	ltyq.exe	svchost.exe
PID 2144 wrote to memory of 2120	2144	ltyq.exe	svchost.exe
PID 2144 wrote to memory of 2120	2144	ltyq.exe	svchost.exe
PID 2144 wrote to memory of 2120	2144	ltyq.exe	svchost.exe
PID 1972 wrote to memory of 2472	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	cmd.exe
PID 1972 wrote to memory of 2472	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	cmd.exe
PID 1972 wrote to memory of 2472	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	cmd.exe
PID 1972 wrote to memory of 2472	1972	297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2068

C:\Users\Admin\AppData\Local\Temp\297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\297562b2a02789dd03deb8207e9c637f_JaffaCakes118.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\ltyq.exe
"C:\Users\Admin\ltyq.exe" /r
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2968

C:\Users\Admin\ltyq.exe
"C:\Users\Admin\ltyq.exe" /r
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\SysWOW64\svchost.exe
svchost.exe
5⤵
PID:2120

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\0673.bat" "
3⤵
- Deletes itself
PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0673.bat

Filesize
117B

MD5
9a403efb1cd6a0a4e735121126280e20

SHA1
89267f37a9f81e602b5d483b007a5ba0ef0d48c5

SHA256
1002136b1a92b7f6732c5355f7d884e1d46ab373844134286787ce37874c3d15

SHA512
87caf552aceb7562fc36dce1d85e33bb183a1a7b850c6f675519955160326329f07af60dae901953daf852ebb35692076f35af1cc2fbbc82e1cbb12d8cd562e9

Download Submit
\Users\Admin\ltyq.exe

Filesize
99KB

MD5
297562b2a02789dd03deb8207e9c637f

SHA1
3e8df0c99673b561cb8422111587a628af006dd3

SHA256
207acfca1de1938e54d115382a281816e4c0144001010f677234f34c56f67d0e

SHA512
183c7a25187aa18e6348657e76d5a76f89ed359a61e86a0fc0fa1deb2b27874b35c35db61fa32aca642eeee367d4a8f180175607b4f552502e9fdcef5e9a194e

Download Submit
memory/1972-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-58-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1972-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2120-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2120-40-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2120-48-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2120-43-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2120-60-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2144-36-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads