tofsee | 3e126f15e4c7dbfee20721b323e5788742c63d9935e8eb6a01b432df3ff17a2c

General

Target

5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe
Size

10.9MB
MD5

5493970c06b98da67f686ecce0b32216
SHA1

d7d319a8ab82614061b4e6baacae669abad81bc9
SHA256

3e126f15e4c7dbfee20721b323e5788742c63d9935e8eb6a01b432df3ff17a2c
SHA512

f845799e953300b0223b2325af61b105bb85eddf1c95d87a33f64601870a99b05341b47418be2831a871e05c08ae0cafa075dbdb1f0ea51c9945fc5f77f7e34e
SSDEEP

196608:a5qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqX:a

Score

10^/10

tofsee evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2940 netsh.exe

pid	process
2940	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\tccjflgr\ImagePath = "C:\\Windows\\SysWOW64\\tccjflgr\\kaaapgme.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

4764 svchost.exe
Executes dropped EXE 1 IoCs

Processes:

kaaapgme.exe

pid process

5060 kaaapgme.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

kaaapgme.exe

description pid process target process

PID 5060 set thread context of 4764 5060 kaaapgme.exe svchost.exe
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

1520 sc.exe
3800 sc.exe
3492 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4764	svchost.exe

pid	process
5060	kaaapgme.exe

description	pid	process	target process
PID 5060 set thread context of 4764	5060	kaaapgme.exe	svchost.exe

pid	process
1520	sc.exe
3800	sc.exe
3492	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4260 1596 WerFault.exe 5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe
864 5060 WerFault.exe kaaapgme.exe

pid	pid_target	process	target process
4260	1596	WerFault.exe	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe
864	5060	WerFault.exe	kaaapgme.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

5493970c06b98da67f686ecce0b32216_JaffaCakes118.exekaaapgme.exe

description	pid	process	target process
PID 1596 wrote to memory of 1768	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	cmd.exe
PID 1596 wrote to memory of 1768	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	cmd.exe
PID 1596 wrote to memory of 1768	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	cmd.exe
PID 1596 wrote to memory of 2808	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	cmd.exe
PID 1596 wrote to memory of 2808	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	cmd.exe
PID 1596 wrote to memory of 2808	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	cmd.exe
PID 1596 wrote to memory of 1520	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 1520	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 1520	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 3800	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 3800	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 3800	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 3492	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 3492	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 3492	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	sc.exe
PID 1596 wrote to memory of 2940	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	netsh.exe
PID 1596 wrote to memory of 2940	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	netsh.exe
PID 1596 wrote to memory of 2940	1596	5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe	netsh.exe
PID 5060 wrote to memory of 4764	5060	kaaapgme.exe	svchost.exe
PID 5060 wrote to memory of 4764	5060	kaaapgme.exe	svchost.exe
PID 5060 wrote to memory of 4764	5060	kaaapgme.exe	svchost.exe
PID 5060 wrote to memory of 4764	5060	kaaapgme.exe	svchost.exe
PID 5060 wrote to memory of 4764	5060	kaaapgme.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tccjflgr\
2⤵
PID:1768

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kaaapgme.exe" C:\Windows\SysWOW64\tccjflgr\
2⤵
PID:2808

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" create tccjflgr binPath= "C:\Windows\SysWOW64\tccjflgr\kaaapgme.exe /d\"C:\Users\Admin\AppData\Local\Temp\5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
2⤵
- Launches sc.exe
PID:1520

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" description tccjflgr "wifi internet conection"
2⤵
- Launches sc.exe
PID:3800

C:\Windows\SysWOW64\sc.exe
"C:\Windows\System32\sc.exe" start tccjflgr
2⤵
- Launches sc.exe
PID:3492

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1036
2⤵
- Program crash
PID:4260

C:\Windows\SysWOW64\tccjflgr\kaaapgme.exe
C:\Windows\SysWOW64\tccjflgr\kaaapgme.exe /d"C:\Users\Admin\AppData\Local\Temp\5493970c06b98da67f686ecce0b32216_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\svchost.exe
svchost.exe
2⤵
- Sets service image path in registry
- Deletes itself
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 532
2⤵
- Program crash
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1596 -ip 1596
1⤵
PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5060 -ip 5060
1⤵
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kaaapgme.exe
Filesize
12.1MB

MD5
63115f8d1de4368ce71165f9919d17e3

SHA1
c49bd104201bdef9f5412da325145623a71f7174

SHA256
7368018ea964b570bb842fa862004b78308c105751a7cbfa59ed7d934a702fc9

SHA512
809e73734b4c05c47778076915c9718e75394e11c38b2288ffd570b01635559d6e95b151853fa3a3de246ee622acf0c82261e6d15f567f8a5e7a4d32fec84629

Download Submit
memory/1596-8-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/1596-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1596-2-0x00000000001E0000-0x00000000001F3000-memory.dmp

Filesize
76KB

Download
memory/1596-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1596-9-0x00000000001E0000-0x00000000001F3000-memory.dmp

Filesize
76KB

Download
memory/1596-1-0x0000000000BC0000-0x0000000000CC0000-memory.dmp

Filesize
1024KB

Download
memory/4764-14-0x0000000000650000-0x0000000000665000-memory.dmp

Filesize
84KB

Download
memory/4764-16-0x0000000000650000-0x0000000000665000-memory.dmp

Filesize
84KB

Download
memory/4764-17-0x0000000000650000-0x0000000000665000-memory.dmp

Filesize
84KB

Download
memory/5060-11-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/5060-12-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/5060-13-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download
memory/5060-18-0x0000000000400000-0x0000000000871000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads