tofsee | 3efe22a84b570ddcb8fcb1e4669706957a1cadc7c744e9f7f767032fba94ce16

General

Target

b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe
Size

12.5MB
MD5

b449be414eabb477f6681adb617b72d5
SHA1

5b6e21ba01ddbdd3bf99534c2bda2716b42a74c1
SHA256

3efe22a84b570ddcb8fcb1e4669706957a1cadc7c744e9f7f767032fba94ce16
SHA512

c1f3df85fd46e8a4feae957ce8190bc741c30df4882e771de1874a1f43cc2707eeef83b4230b75d06d2acbe2bdafeb73761baadc66233b270a68cfefd1ac58a8
SSDEEP

6144:DesoFeYHECHsLsx6mihb12P5qpWV0m68jM7LjmpeM:Dnu/HECz6S5QWlnqOpe

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1612	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bduumwpz\ImagePath = "C:\\Windows\\SysWOW64\\bduumwpz\\jvqnutth.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe

Deletes itself 1 IoCs

pid	Process
2444	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2316	jvqnutth.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 2444	2316	jvqnutth.exe	98

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
776	sc.exe
3632	sc.exe
1244	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4316	4768	WerFault.exe	80
4928	2316	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jvqnutth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2132	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	81
PID 4768 wrote to memory of 2132	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	81
PID 4768 wrote to memory of 2132	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	81
PID 4768 wrote to memory of 2180	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	84
PID 4768 wrote to memory of 2180	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	84
PID 4768 wrote to memory of 2180	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	84
PID 4768 wrote to memory of 776	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	86
PID 4768 wrote to memory of 776	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	86
PID 4768 wrote to memory of 776	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	86
PID 4768 wrote to memory of 3632	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	88
PID 4768 wrote to memory of 3632	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	88
PID 4768 wrote to memory of 3632	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	88
PID 4768 wrote to memory of 1244	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	90
PID 4768 wrote to memory of 1244	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	90
PID 4768 wrote to memory of 1244	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	90
PID 4768 wrote to memory of 1612	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	93
PID 4768 wrote to memory of 1612	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	93
PID 4768 wrote to memory of 1612	4768	b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe	93
PID 2316 wrote to memory of 2444	2316	jvqnutth.exe	98
PID 2316 wrote to memory of 2444	2316	jvqnutth.exe	98
PID 2316 wrote to memory of 2444	2316	jvqnutth.exe	98
PID 2316 wrote to memory of 2444	2316	jvqnutth.exe	98
PID 2316 wrote to memory of 2444	2316	jvqnutth.exe	98

C:\Users\Admin\AppData\Local\Temp\b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bduumwpz\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jvqnutth.exe" C:\Windows\SysWOW64\bduumwpz\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create bduumwpz binPath= "C:\Windows\SysWOW64\bduumwpz\jvqnutth.exe /d\"C:\Users\Admin\AppData\Local\Temp\b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:776
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description bduumwpz "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3632
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start bduumwpz
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1244
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 1272
  2⤵
  - Program crash
  PID:4316

C:\Windows\SysWOW64\bduumwpz\jvqnutth.exe
C:\Windows\SysWOW64\bduumwpz\jvqnutth.exe /d"C:\Users\Admin\AppData\Local\Temp\b449be414eabb477f6681adb617b72d5_JaffaCakes118.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 532
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4768 -ip 4768
1⤵
PID:2876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2316 -ip 2316
1⤵
PID:412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\jvqnutth.exe

Filesize
12.6MB

MD5
4f7f85649f2ef0bd99f3ab89f46b806a

SHA1
3770d7d20dc7b86a9897612ee775cd88823ea8ea

SHA256
cd4fbcaf09e082f6bfc61a5dc3462050df679fb7aca5cde59d2dbcf94ce65e67

SHA512
df52fd8ed8d2a429462535f1680659c674cddcdce494024fb9c30d63b25b36115d3c58e0e81eb6ebcf91fe6a314650a186860c719e13107726a78c65aac9ee43

Download Submit
memory/2316-11-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2316-15-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download
memory/2444-14-0x0000000000950000-0x0000000000965000-memory.dmp

Filesize
84KB

Download
memory/2444-12-0x0000000000950000-0x0000000000965000-memory.dmp

Filesize
84KB

Download
memory/2444-16-0x0000000000950000-0x0000000000965000-memory.dmp

Filesize
84KB

Download
memory/4768-1-0x0000000000A20000-0x0000000000B20000-memory.dmp

Filesize
1024KB

Download
memory/4768-2-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/4768-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4768-9-0x00000000001C0000-0x00000000001D3000-memory.dmp

Filesize
76KB

Download
memory/4768-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4768-8-0x0000000000400000-0x000000000086B000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads