tofsee | 53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0

General

Target

JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe
Size

246KB
MD5

e030c51b0ced4c62a924f9e7bbadc75b
SHA1

f265f8063c3ddd2d173b88e7be57bffe59e97dae
SHA256

53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0
SHA512

432b0116d1eaf25cca1c1f7317d0ec845e7b948789fd7ba97808a986bbb6bf0396153bff0f4a53ade7e49b6bba13936d296ca374f34fd7ce5f9828c0483a7cb9
SSDEEP

3072:/7OwU3TAyXWuXNWZ6ufWKbzTASuqbgdgsF54VggjcGkNIVqIpEVE:MTAyxX+6ueKbzTAIIdM7ITsqUEK

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3820	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wemxpxbs\ImagePath = "C:\\Windows\\SysWOW64\\wemxpxbs\\kjdyymzg.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe

Deletes itself 1 IoCs

pid	Process
1036	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2804	kjdyymzg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2804 set thread context of 1036	2804	kjdyymzg.exe	100

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4900	sc.exe
3012	sc.exe
5004	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1448	1804	WerFault.exe	83
3744	2804	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kjdyymzg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4328	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	84
PID 1804 wrote to memory of 4328	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	84
PID 1804 wrote to memory of 4328	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	84
PID 1804 wrote to memory of 2428	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	86
PID 1804 wrote to memory of 2428	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	86
PID 1804 wrote to memory of 2428	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	86
PID 1804 wrote to memory of 4900	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	88
PID 1804 wrote to memory of 4900	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	88
PID 1804 wrote to memory of 4900	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	88
PID 1804 wrote to memory of 3012	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	90
PID 1804 wrote to memory of 3012	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	90
PID 1804 wrote to memory of 3012	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	90
PID 1804 wrote to memory of 5004	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	92
PID 1804 wrote to memory of 5004	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	92
PID 1804 wrote to memory of 5004	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	92
PID 1804 wrote to memory of 3820	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	95
PID 1804 wrote to memory of 3820	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	95
PID 1804 wrote to memory of 3820	1804	JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe	95
PID 2804 wrote to memory of 1036	2804	kjdyymzg.exe	100
PID 2804 wrote to memory of 1036	2804	kjdyymzg.exe	100
PID 2804 wrote to memory of 1036	2804	kjdyymzg.exe	100
PID 2804 wrote to memory of 1036	2804	kjdyymzg.exe	100
PID 2804 wrote to memory of 1036	2804	kjdyymzg.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wemxpxbs\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kjdyymzg.exe" C:\Windows\SysWOW64\wemxpxbs\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create wemxpxbs binPath= "C:\Windows\SysWOW64\wemxpxbs\kjdyymzg.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description wemxpxbs "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3012
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start wemxpxbs
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5004
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 812
  2⤵
  - Program crash
  PID:1448

C:\Windows\SysWOW64\wemxpxbs\kjdyymzg.exe
C:\Windows\SysWOW64\wemxpxbs\kjdyymzg.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_53e44288e55e4f096aa45b2dbab426984680aa13844fc22a66ca8cea9fc239e0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 516
  2⤵
  - Program crash
  PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1804 -ip 1804
1⤵
PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2804 -ip 2804
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\kjdyymzg.exe

Filesize
12.1MB

MD5
35b1acc9f90f719a9ea53585b9010113

SHA1
3d68837441aa3b59109a9335e585fb782103988e

SHA256
e7d790b5b0b65521acb3f56835acd9795ca43b9125a71b8cae24607b2237bf6f

SHA512
1ca77933925a29083177ddf6c572d6fad04934954ada039d23210a668f08de490ec1908aa0fbdeffcc660295c5ca6147c1883a8be86794f02bb1c2ff16f23410

Download Submit
memory/1036-14-0x0000000000B40000-0x0000000000B55000-memory.dmp

Filesize
84KB

Download
memory/1036-16-0x0000000000B40000-0x0000000000B55000-memory.dmp

Filesize
84KB

Download
memory/1036-12-0x0000000000B40000-0x0000000000B55000-memory.dmp

Filesize
84KB

Download
memory/1804-7-0x0000000002270000-0x000000000227D000-memory.dmp

Filesize
52KB

Download
memory/1804-8-0x0000000002280000-0x0000000002293000-memory.dmp

Filesize
76KB

Download
memory/1804-0-0x0000000002270000-0x000000000227D000-memory.dmp

Filesize
52KB

Download
memory/1804-6-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/1804-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1804-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1804-1-0x0000000002280000-0x0000000002293000-memory.dmp

Filesize
76KB

Download
memory/2804-10-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2804-11-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2804-15-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2804-17-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads