tofsee | 26a32c9e6d4556f1125710008c3702b6a51b8ce0419af21cd3a405673670f38e

General

Target

46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe
Size

14.6MB
MD5

46272a7c3e82453b849b604d502931b6
SHA1

d43ab2e01219f1b6b79b5c9e83a12b093a891e72
SHA256

26a32c9e6d4556f1125710008c3702b6a51b8ce0419af21cd3a405673670f38e
SHA512

91f62a9552002777652249b5454b551aa064b703104b1e4239a7a3713de2b1d8a8ad1e9a2ecf22c0507f74c4f2f11dbeb1da2421456c0e63b4aebf5f83b7b48a
SSDEEP

49152:acUGb2222222222222222222222222222222222222222222222222222222222O:acU

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
8	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rvhoaapq\ImagePath = "C:\\Windows\\SysWOW64\\rvhoaapq\\bsayidky.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
3532	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1540	bsayidky.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1540 set thread context of 3532	1540	bsayidky.exe	104

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
864	sc.exe
4260	sc.exe
3556	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5096	4836	WerFault.exe	83
1584	1540	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsayidky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2344	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	87
PID 4836 wrote to memory of 2344	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	87
PID 4836 wrote to memory of 2344	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	87
PID 4836 wrote to memory of 3896	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	89
PID 4836 wrote to memory of 3896	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	89
PID 4836 wrote to memory of 3896	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	89
PID 4836 wrote to memory of 864	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	91
PID 4836 wrote to memory of 864	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	91
PID 4836 wrote to memory of 864	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	91
PID 4836 wrote to memory of 4260	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	93
PID 4836 wrote to memory of 4260	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	93
PID 4836 wrote to memory of 4260	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	93
PID 4836 wrote to memory of 3556	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	95
PID 4836 wrote to memory of 3556	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	95
PID 4836 wrote to memory of 3556	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	95
PID 4836 wrote to memory of 8	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	100
PID 4836 wrote to memory of 8	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	100
PID 4836 wrote to memory of 8	4836	46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe	100
PID 1540 wrote to memory of 3532	1540	bsayidky.exe	104
PID 1540 wrote to memory of 3532	1540	bsayidky.exe	104
PID 1540 wrote to memory of 3532	1540	bsayidky.exe	104
PID 1540 wrote to memory of 3532	1540	bsayidky.exe	104
PID 1540 wrote to memory of 3532	1540	bsayidky.exe	104

C:\Users\Admin\AppData\Local\Temp\46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rvhoaapq\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bsayidky.exe" C:\Windows\SysWOW64\rvhoaapq\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3896
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create rvhoaapq binPath= "C:\Windows\SysWOW64\rvhoaapq\bsayidky.exe /d\"C:\Users\Admin\AppData\Local\Temp\46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:864
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description rvhoaapq "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4260
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start rvhoaapq
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3556
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:8
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 1036
  2⤵
  - Program crash
  PID:5096

C:\Windows\SysWOW64\rvhoaapq\bsayidky.exe
C:\Windows\SysWOW64\rvhoaapq\bsayidky.exe /d"C:\Users\Admin\AppData\Local\Temp\46272a7c3e82453b849b604d502931b6_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 560
  2⤵
  - Program crash
  PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4836 -ip 4836
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1540 -ip 1540
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bsayidky.exe

Filesize
12.7MB

MD5
e5879210c7d37389b299b73eff9858ce

SHA1
85b49e88510444060d3c3eba448397a699cea71c

SHA256
907d4d7435142e4f6b8132c341b38ab293f857ec0eb96302b3d1a67235ce909d

SHA512
5f7dbec9f81c72e1f40e7646a150d42708093c9f0f00ca3d4122bbf1f1654dda8548ed36b58e870adf0614a89e5e31573f7f492ba0b2f924cd160a8d9d70f8df

Download Submit
memory/1540-8-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1540-20-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1540-10-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/1540-9-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/3532-15-0x0000000000310000-0x0000000000325000-memory.dmp

Filesize
84KB

Download
memory/3532-11-0x0000000000310000-0x0000000000325000-memory.dmp

Filesize
84KB

Download
memory/3532-21-0x0000000000310000-0x0000000000325000-memory.dmp

Filesize
84KB

Download
memory/3532-22-0x0000000000310000-0x0000000000325000-memory.dmp

Filesize
84KB

Download
memory/3532-23-0x0000000000310000-0x0000000000325000-memory.dmp

Filesize
84KB

Download
memory/4836-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4836-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/4836-14-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download
memory/4836-18-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4836-16-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4836-17-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/4836-1-0x0000000000560000-0x0000000000660000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads