tofsee | dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d

General

Target

JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe
Size

344KB
MD5

0b19684e42bf520f8f19611243f09f25
SHA1

8adc00499e77918f089b64af6442883127d8d5c2
SHA256

dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d
SHA512

81509fad5379c5fc6b3f1a1dd6121d2bc879c82550b3783c415df610c70c3592c0aa4cf593fec136f112d9b6d6a8bded2dd29f5a9cb17355a49680e6089367cf
SSDEEP

6144:ygoASmiF7pGffyhLsxAOC9H+DWfGMI8WrZn:d4ayxsxAOC9eDWf05V

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

mubrikych.top

oxxyfix.xyz

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
380	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\miqtbjpz\ImagePath = "C:\\Windows\\SysWOW64\\miqtbjpz\\ierdlopw.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe

Deletes itself 1 IoCs

pid	Process
2808	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	ierdlopw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4356 set thread context of 2808	4356	ierdlopw.exe	101

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5028	sc.exe
2340	sc.exe
4304	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
624	460	WerFault.exe	82
2784	4356	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ierdlopw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4640	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	83
PID 460 wrote to memory of 4640	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	83
PID 460 wrote to memory of 4640	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	83
PID 460 wrote to memory of 1404	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	86
PID 460 wrote to memory of 1404	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	86
PID 460 wrote to memory of 1404	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	86
PID 460 wrote to memory of 5028	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	88
PID 460 wrote to memory of 5028	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	88
PID 460 wrote to memory of 5028	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	88
PID 460 wrote to memory of 2340	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	90
PID 460 wrote to memory of 2340	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	90
PID 460 wrote to memory of 2340	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	90
PID 460 wrote to memory of 4304	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	92
PID 460 wrote to memory of 4304	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	92
PID 460 wrote to memory of 4304	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	92
PID 460 wrote to memory of 380	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	95
PID 460 wrote to memory of 380	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	95
PID 460 wrote to memory of 380	460	JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe	95
PID 4356 wrote to memory of 2808	4356	ierdlopw.exe	101
PID 4356 wrote to memory of 2808	4356	ierdlopw.exe	101
PID 4356 wrote to memory of 2808	4356	ierdlopw.exe	101
PID 4356 wrote to memory of 2808	4356	ierdlopw.exe	101
PID 4356 wrote to memory of 2808	4356	ierdlopw.exe	101

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\miqtbjpz\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ierdlopw.exe" C:\Windows\SysWOW64\miqtbjpz\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1404
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create miqtbjpz binPath= "C:\Windows\SysWOW64\miqtbjpz\ierdlopw.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description miqtbjpz "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2340
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start miqtbjpz
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4304
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 1164
  2⤵
  - Program crash
  PID:624

C:\Windows\SysWOW64\miqtbjpz\ierdlopw.exe
C:\Windows\SysWOW64\miqtbjpz\ierdlopw.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dcdc08d7a2a8a7bf9e9c13f7fc0f98cabe9cf01b9393385d99dc78d7aae7635d.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 512
  2⤵
  - Program crash
  PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 460 -ip 460
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4356 -ip 4356
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ierdlopw.exe

Filesize
15.0MB

MD5
a89383dc7f22cf5ddf5ed9cea340628e

SHA1
05214c4f3c5cd86114959395528d1ebdfefe4f77

SHA256
2c8432b6d81b09b025b42c0bd19c35e1cc50ad943715084b4fb2c0e8219868c5

SHA512
70d6c8061896a0927925840cbbd5b617c6f103af16b41b0ce5f513fed3a24705d3ff4f70e2c4fe62430b70ff83c55f2fa59b5841e34c2e9a79d4f5f0a0c525e9

Download Submit
memory/460-7-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/460-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/460-2-0x00000000020E0000-0x00000000020F3000-memory.dmp

Filesize
76KB

Download
memory/460-9-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/460-8-0x00000000020E0000-0x00000000020F3000-memory.dmp

Filesize
76KB

Download
memory/460-1-0x00000000006E0000-0x00000000007E0000-memory.dmp

Filesize
1024KB

Download
memory/2808-14-0x0000000001280000-0x0000000001295000-memory.dmp

Filesize
84KB

Download
memory/2808-16-0x0000000001280000-0x0000000001295000-memory.dmp

Filesize
84KB

Download
memory/2808-17-0x0000000001280000-0x0000000001295000-memory.dmp

Filesize
84KB

Download
memory/4356-11-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4356-13-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4356-12-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/4356-19-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads