tofsee | 6e89a44a73818b439f124147d2024fec5d2f8a00054e45795d5a7d7fca97d026

General

Target

65437df61660e464407c0934040d1870_JaffaCakes118.exe
Size

144KB
MD5

65437df61660e464407c0934040d1870
SHA1

41f351a6802c4219fa7ee85973c27c393647ef73
SHA256

6e89a44a73818b439f124147d2024fec5d2f8a00054e45795d5a7d7fca97d026
SHA512

f3a539f886be53323d68f2894edb0e39b9cf0417def99bb5b8e48ff5a8555302723662ce7a386f038331b02add0dccd2552832d819cc949318cb7fa8d9a1870b
SSDEEP

3072:uaVP6HaGT5SR8fGzIpYDx1cTqO9lkS2jbxWGq8Wr:uaGoEpWxSbGq8k

Score

10^/10

tofsee discovery persistence trojan

Malware Config

Extracted

Family

tofsee

C2

91.218.39.211

188.130.237.44

91.204.162.103

188.165.132.183

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2752 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

fgywwqiv.exe

pid process

2008 fgywwqiv.exe
Loads dropped DLL 2 IoCs

Processes:

65437df61660e464407c0934040d1870_JaffaCakes118.exe

pid process

2684 65437df61660e464407c0934040d1870_JaffaCakes118.exe
2684 65437df61660e464407c0934040d1870_JaffaCakes118.exe

pid	process
2752	cmd.exe

pid	process
2008	fgywwqiv.exe

pid	process
2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe
2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

65437df61660e464407c0934040d1870_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "\"C:\\Users\\Admin\\fgywwqiv.exe\""	65437df61660e464407c0934040d1870_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

fgywwqiv.exe

description pid process target process

PID 2008 set thread context of 2884 2008 fgywwqiv.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2008 set thread context of 2884	2008	fgywwqiv.exe	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

svchost.execmd.exe65437df61660e464407c0934040d1870_JaffaCakes118.exefgywwqiv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65437df61660e464407c0934040d1870_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fgywwqiv.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

65437df61660e464407c0934040d1870_JaffaCakes118.exefgywwqiv.exe

pid process

2684 65437df61660e464407c0934040d1870_JaffaCakes118.exe
2008 fgywwqiv.exe

pid	process
2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe
2008	fgywwqiv.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

65437df61660e464407c0934040d1870_JaffaCakes118.exefgywwqiv.exe

description	pid	process	target process
PID 2684 wrote to memory of 2008	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	fgywwqiv.exe
PID 2684 wrote to memory of 2008	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	fgywwqiv.exe
PID 2684 wrote to memory of 2008	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	fgywwqiv.exe
PID 2684 wrote to memory of 2008	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	fgywwqiv.exe
PID 2008 wrote to memory of 2884	2008	fgywwqiv.exe	svchost.exe
PID 2008 wrote to memory of 2884	2008	fgywwqiv.exe	svchost.exe
PID 2008 wrote to memory of 2884	2008	fgywwqiv.exe	svchost.exe
PID 2008 wrote to memory of 2884	2008	fgywwqiv.exe	svchost.exe
PID 2008 wrote to memory of 2884	2008	fgywwqiv.exe	svchost.exe
PID 2008 wrote to memory of 2884	2008	fgywwqiv.exe	svchost.exe
PID 2684 wrote to memory of 2752	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	cmd.exe
PID 2684 wrote to memory of 2752	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	cmd.exe
PID 2684 wrote to memory of 2752	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	cmd.exe
PID 2684 wrote to memory of 2752	2684	65437df61660e464407c0934040d1870_JaffaCakes118.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\65437df61660e464407c0934040d1870_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\65437df61660e464407c0934040d1870_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Users\Admin\fgywwqiv.exe
  "C:\Users\Admin\fgywwqiv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\2150.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2150.bat

Filesize
266B

MD5
840a9bac596baececfb690932d11c01c

SHA1
2a7fd03c1f5107cbac73138486f049f5b5cf1830

SHA256
55783e95e655e6b2ba92eaef8dd9472cfcbda29c40e1d90956ecc5ba95135114

SHA512
0d91028813eb6714d9f2bbcb8778fd6710ad3abe83c9ad11d078aaf26f56b35ad7fd4ea9a330a276d18cba2b26dd812ee81455a357e40cdde9f4f111727bc9d2

Download Submit
\Users\Admin\fgywwqiv.exe

Filesize
44.1MB

MD5
17331d00d3a7798c1543717d39a54676

SHA1
f42ff25be9f593ef73ae14c44a803747e95f4c1f

SHA256
35331aae01c9db87239cef34fc28903bc149ef2bd94e42bf4c8f54b153bb4382

SHA512
86afc8e79f330768450735b8c67393b0c653b432b32add17f67b1052a7ba96036088540ca8669fc499c266fda3831ea26ef9f636978ca61fdc882f94b0ad42a5

Download Submit
memory/2008-12-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2008-11-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/2008-18-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-38-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2684-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-37-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2684-0-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2884-22-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/2884-23-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/2884-29-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/2884-16-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/2884-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2884-13-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download
memory/2884-27-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2884-40-0x00000000000D0000-0x00000000000E2000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads