tofsee | a96551184842a79eba81afb733e1f2807f7e9fa286c90a183e0ab7e2805b6b97

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-08-2024 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
Size

170KB
MD5

c58a6b85fd1ecf61086b52f3a3794a1f
SHA1

ab2fcc8ed5ee1d7efdfc808a8caaf54fae5b8f5f
SHA256

a96551184842a79eba81afb733e1f2807f7e9fa286c90a183e0ab7e2805b6b97
SHA512

7693dca5c4378b2ac57fd5e71551ca7ac740c6192f364c1a2ae987bb4b8591d3167b9a79be8f7023525c3e2335d78286331a096a70946881a301065ce69486ba
SSDEEP

3072:TyyL6e5KJOUM8GXLimIolLU+tzjYvOafr2x6ZSdp/s6LIxU:TrWe8oiGnVYdfeZU21

Score

10^/10

tofsee discovery persistence trojan

Malware Config

Extracted

Family

tofsee

64.20.54.234

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2936	ysfhh.exe
2852	ysfhh.exe

Loads dropped DLL 3 IoCs

pid	Process
476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
2936	ysfhh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\ysfhh.exe\" /r"	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2984 set thread context of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2936 set thread context of 2852	2936	ysfhh.exe	34
PID 2852 set thread context of 2732	2852	ysfhh.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysfhh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysfhh.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 2984 wrote to memory of 476	2984	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	31
PID 476 wrote to memory of 2936	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	32
PID 476 wrote to memory of 2936	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	32
PID 476 wrote to memory of 2936	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	32
PID 476 wrote to memory of 2936	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	32
PID 476 wrote to memory of 2816	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	33
PID 476 wrote to memory of 2816	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	33
PID 476 wrote to memory of 2816	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	33
PID 476 wrote to memory of 2816	476	c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2936 wrote to memory of 2852	2936	ysfhh.exe	34
PID 2852 wrote to memory of 2732	2852	ysfhh.exe	36
PID 2852 wrote to memory of 2732	2852	ysfhh.exe	36
PID 2852 wrote to memory of 2732	2852	ysfhh.exe	36
PID 2852 wrote to memory of 2732	2852	ysfhh.exe	36
PID 2852 wrote to memory of 2732	2852	ysfhh.exe	36
PID 2852 wrote to memory of 2732	2852	ysfhh.exe	36

C:\Users\Admin\AppData\Local\Temp\c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\c58a6b85fd1ecf61086b52f3a3794a1f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Users\Admin\ysfhh.exe
    "C:\Users\Admin\ysfhh.exe" /r
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Users\Admin\ysfhh.exe
      "C:\Users\Admin\ysfhh.exe" /r
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\3635.bat" "
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3635.bat

Filesize
117B

MD5
a25a0f78cb3d73ef5c90e05882c493ee

SHA1
42561ddfcdc4a96c6e70cdd23a05e9a69ad44a5d

SHA256
2e17919ff27dd4793124cfad08c1f31db7f664339a2ba6d17fda22dad67f59eb

SHA512
395364e9bc052eac8828e33b79acec1c2ee9e47ebaa599d021269dd0b41007976da531e9922e7fb60a156b5e1547f3c501fc0c2f48dcaa7f6c1da95c899591a3

Download Submit
\Users\Admin\ysfhh.exe

Filesize
170KB

MD5
c58a6b85fd1ecf61086b52f3a3794a1f

SHA1
ab2fcc8ed5ee1d7efdfc808a8caaf54fae5b8f5f

SHA256
a96551184842a79eba81afb733e1f2807f7e9fa286c90a183e0ab7e2805b6b97

SHA512
7693dca5c4378b2ac57fd5e71551ca7ac740c6192f364c1a2ae987bb4b8591d3167b9a79be8f7023525c3e2335d78286331a096a70946881a301065ce69486ba

Download Submit
memory/476-32-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-14-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-4-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-2-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/476-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2732-58-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2732-51-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2732-53-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2732-60-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2732-63-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2732-64-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2732-65-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2852-49-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2852-48-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads