tofsee | a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82

General

Target

JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe
Size

209KB
MD5

0d7956955bc6e9a59379be3e1c32b521
SHA1

3c30a13b7338b20537743d2c4f26a3f848895afa
SHA256

a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82
SHA512

3e44ec1980dab1e2480e95e1af37a9e865140ce400445e90babdd884885a25f51c9732241fbf4396d84a1c9c253a94947fa38468ad1684e47ae6c511de496c28
SSDEEP

3072:l7o+8bY15UT/8c4UhnRc6OAK4MdHU0qiRHJWrxpzbgqru2sxkgaBChH:CDE15UTk+cKK4MOUJuzbgwujiga

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2192	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cewmsszw\ImagePath = "C:\\Windows\\SysWOW64\\cewmsszw\\dstzmxrq.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe

Deletes itself 1 IoCs

pid	Process
2536	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	dstzmxrq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1956 set thread context of 2536	1956	dstzmxrq.exe	100

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1796	sc.exe
3428	sc.exe
4824	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2356	1528	WerFault.exe	82
3556	1956	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dstzmxrq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3300	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	83
PID 1528 wrote to memory of 3300	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	83
PID 1528 wrote to memory of 3300	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	83
PID 1528 wrote to memory of 4424	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	85
PID 1528 wrote to memory of 4424	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	85
PID 1528 wrote to memory of 4424	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	85
PID 1528 wrote to memory of 1796	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	87
PID 1528 wrote to memory of 1796	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	87
PID 1528 wrote to memory of 1796	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	87
PID 1528 wrote to memory of 3428	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	89
PID 1528 wrote to memory of 3428	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	89
PID 1528 wrote to memory of 3428	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	89
PID 1528 wrote to memory of 4824	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	91
PID 1528 wrote to memory of 4824	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	91
PID 1528 wrote to memory of 4824	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	91
PID 1528 wrote to memory of 2192	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	94
PID 1528 wrote to memory of 2192	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	94
PID 1528 wrote to memory of 2192	1528	JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe	94
PID 1956 wrote to memory of 2536	1956	dstzmxrq.exe	100
PID 1956 wrote to memory of 2536	1956	dstzmxrq.exe	100
PID 1956 wrote to memory of 2536	1956	dstzmxrq.exe	100
PID 1956 wrote to memory of 2536	1956	dstzmxrq.exe	100
PID 1956 wrote to memory of 2536	1956	dstzmxrq.exe	100

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cewmsszw\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dstzmxrq.exe" C:\Windows\SysWOW64\cewmsszw\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4424
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create cewmsszw binPath= "C:\Windows\SysWOW64\cewmsszw\dstzmxrq.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1796
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description cewmsszw "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start cewmsszw
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4824
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1160
  2⤵
  - Program crash
  PID:2356

C:\Windows\SysWOW64\cewmsszw\dstzmxrq.exe
C:\Windows\SysWOW64\cewmsszw\dstzmxrq.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a95db7a0471f2717606aab2a74d677670a01d3ec9f1dd642b278151d19bd1d82.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 512
  2⤵
  - Program crash
  PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1528 -ip 1528
1⤵
PID:2516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1956 -ip 1956
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dstzmxrq.exe

Filesize
13.3MB

MD5
bd43e2f2e30973da895f2cb7e1f41ed2

SHA1
f3cda07c0cd6c4d04134d812640f518599c7584f

SHA256
a8a938189f179cf74c4bda1352b5cdd62ac724afd4ba99f2cf6085eaaa21ca14

SHA512
4451fa3b36190c382aa6ce7b2b431ad7779a638270a35f82d5d1fbfaa82d07984dba4b7ecd6777f4ec02e84b4ef74ca07fcd7e8b05b3fca448d3dbefae586f17

Download Submit
memory/1528-8-0x0000000002040000-0x000000000204D000-memory.dmp

Filesize
52KB

Download
memory/1528-1-0x0000000002070000-0x0000000002083000-memory.dmp

Filesize
76KB

Download
memory/1528-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1528-9-0x0000000002070000-0x0000000002083000-memory.dmp

Filesize
76KB

Download
memory/1528-6-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1528-0-0x0000000002040000-0x000000000204D000-memory.dmp

Filesize
52KB

Download
memory/1528-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1956-7-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1956-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2536-13-0x0000000000990000-0x00000000009A5000-memory.dmp

Filesize
84KB

Download
memory/2536-11-0x0000000000990000-0x00000000009A5000-memory.dmp

Filesize
84KB

Download
memory/2536-14-0x0000000000990000-0x00000000009A5000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads