tofsee | bfd23b4120f227dfbc5870e08af77db419cd90e3527ca6bb6c31683458602fa8

General

Target

36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe
Size

11.8MB
MD5

36d5664fd330c5e6cb0d7e31d8e0513f
SHA1

1917c1eba422f9d2076c072162d63f46ecfa5222
SHA256

bfd23b4120f227dfbc5870e08af77db419cd90e3527ca6bb6c31683458602fa8
SHA512

528401bc0cd09b9667d47b973bfa8cc43e727f98eaf69e278efa6ecb3c103aae38dc51a27efb68d7d6b4d8374b38ca97df483e9c6d82e157fa1e9e38ac7eac64
SSDEEP

24576:ZRQITb1qsssssssssssssssssssssssssssssssssssssssssssssssssssssss/:N

Score

10^/10

tofsee evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3324 netsh.exe

pid	process
3324	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\yeiafhju\ImagePath = "C:\\Windows\\SysWOW64\\yeiafhju\\selfkqdl.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4444 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

selfkqdl.exe

pid process

808 selfkqdl.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

selfkqdl.exe

description pid process target process

PID 808 set thread context of 4444 808 selfkqdl.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

2400 sc.exe
396 sc.exe
976 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4444	svchost.exe

pid	process
808	selfkqdl.exe

description	pid	process	target process
PID 808 set thread context of 4444	808	selfkqdl.exe	svchost.exe

pid	process
2400	sc.exe
396	sc.exe
976	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1496 3396 WerFault.exe 36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe
1740 808 WerFault.exe selfkqdl.exe

pid	pid_target	process	target process
1496	3396	WerFault.exe	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe
1740	808	WerFault.exe	selfkqdl.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exeselfkqdl.exe

description	pid	process	target process
PID 3396 wrote to memory of 1772	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	cmd.exe
PID 3396 wrote to memory of 1772	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	cmd.exe
PID 3396 wrote to memory of 1772	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	cmd.exe
PID 3396 wrote to memory of 4764	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	cmd.exe
PID 3396 wrote to memory of 4764	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	cmd.exe
PID 3396 wrote to memory of 4764	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	cmd.exe
PID 3396 wrote to memory of 2400	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 2400	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 2400	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 396	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 396	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 396	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 976	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 976	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 976	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	sc.exe
PID 3396 wrote to memory of 3324	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	netsh.exe
PID 3396 wrote to memory of 3324	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	netsh.exe
PID 3396 wrote to memory of 3324	3396	36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe	netsh.exe
PID 808 wrote to memory of 4444	808	selfkqdl.exe	svchost.exe
PID 808 wrote to memory of 4444	808	selfkqdl.exe	svchost.exe
PID 808 wrote to memory of 4444	808	selfkqdl.exe	svchost.exe
PID 808 wrote to memory of 4444	808	selfkqdl.exe	svchost.exe
PID 808 wrote to memory of 4444	808	selfkqdl.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3396

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\yeiafhju\
2⤵
PID:1772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\selfkqdl.exe" C:\Windows\SysWOW64\yeiafhju\
2⤵
PID:4764

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create yeiafhju binPath= "C:\Windows\SysWOW64\yeiafhju\selfkqdl.exe /d\"C:\Users\Admin\AppData\Local\Temp\36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:2400

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description yeiafhju "wifi internet conection"
2⤵
- Launches sc.exe
PID:396

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start yeiafhju
2⤵
- Launches sc.exe
PID:976

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 1040
2⤵
- Program crash
PID:1496

C:\Windows\SysWOW64\yeiafhju\selfkqdl.exe
C:\Windows\SysWOW64\yeiafhju\selfkqdl.exe /d"C:\Users\Admin\AppData\Local\Temp\36d5664fd330c5e6cb0d7e31d8e0513f_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 508
2⤵
- Program crash
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3396 -ip 3396
1⤵
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 808 -ip 808
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\selfkqdl.exe
Filesize
12.1MB

MD5
69d005c6ea860760b7a8461ba870c06c

SHA1
b0b52bf63034215adaef8246f29380a0619a2468

SHA256
4efbdc47b687e00ce880dd13bec2a84ac6109cd91099eb701ad9cc7b344028db

SHA512
2c43a24006cc0ac8cf62c61ea3aedac030e3bbc40560b32911e59463f2f51d28d51b2927b22cb295f4203d2fbf553568585717cf7c1fe8836a5b31ecd7fcc7f3

Download Submit
memory/808-13-0x0000000000400000-0x0000000002B90000-memory.dmp

Filesize
39.6MB

Download
memory/3396-1-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/3396-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

Filesize
76KB

Download
memory/3396-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3396-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3396-11-0x00000000001E0000-0x00000000001F3000-memory.dmp

Filesize
76KB

Download
memory/3396-8-0x0000000000400000-0x0000000002B90000-memory.dmp

Filesize
39.6MB

Download
memory/4444-9-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/4444-14-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/4444-15-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads