tofsee | 2896824b730913854e31b41bc3a6df606d85792c03d6b435e73ed8022a7887e7

General

Target

JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe
Size

13.0MB
MD5

5dd36b82638e15936007cf495f55d620
SHA1

3ba72b0f6aeee447d6eda839b20bc30c0dd80f33
SHA256

2896824b730913854e31b41bc3a6df606d85792c03d6b435e73ed8022a7887e7
SHA512

038823445ccc70984e921647ce555a3bc9521aefc4aceae5425a5dff96b780079a74055011f3261d45fbfe22159366c88c4309c2f515beba6866bbadb51ba397
SSDEEP

3072:LwGatcHwtl+h5fYdC7azLpUb2Y5G3wtl+h5fYdC7HIQDrwtR:kGUcHwtls5KCu49I3wtls5KCUQDrwt

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4804	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\adsbdczy\ImagePath = "C:\\Windows\\SysWOW64\\adsbdczy\\lpwgguea.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe

Deletes itself 1 IoCs

pid	Process
1324	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2220	lpwgguea.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 1324	2220	lpwgguea.exe	98

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2668	sc.exe
920	sc.exe
4136	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpwgguea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4676	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	84
PID 1828 wrote to memory of 4676	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	84
PID 1828 wrote to memory of 4676	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	84
PID 1828 wrote to memory of 5112	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	86
PID 1828 wrote to memory of 5112	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	86
PID 1828 wrote to memory of 5112	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	86
PID 1828 wrote to memory of 920	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	88
PID 1828 wrote to memory of 920	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	88
PID 1828 wrote to memory of 920	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	88
PID 1828 wrote to memory of 4136	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	91
PID 1828 wrote to memory of 4136	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	91
PID 1828 wrote to memory of 4136	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	91
PID 1828 wrote to memory of 2668	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	93
PID 1828 wrote to memory of 2668	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	93
PID 1828 wrote to memory of 2668	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	93
PID 1828 wrote to memory of 4804	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	96
PID 1828 wrote to memory of 4804	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	96
PID 1828 wrote to memory of 4804	1828	JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe	96
PID 2220 wrote to memory of 1324	2220	lpwgguea.exe	98
PID 2220 wrote to memory of 1324	2220	lpwgguea.exe	98
PID 2220 wrote to memory of 1324	2220	lpwgguea.exe	98
PID 2220 wrote to memory of 1324	2220	lpwgguea.exe	98
PID 2220 wrote to memory of 1324	2220	lpwgguea.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\adsbdczy\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4676
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lpwgguea.exe" C:\Windows\SysWOW64\adsbdczy\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5112
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create adsbdczy binPath= "C:\Windows\SysWOW64\adsbdczy\lpwgguea.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:920
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description adsbdczy "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4136
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start adsbdczy
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4804

C:\Windows\SysWOW64\adsbdczy\lpwgguea.exe
C:\Windows\SysWOW64\adsbdczy\lpwgguea.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5dd36b82638e15936007cf495f55d620.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lpwgguea.exe

Filesize
10.8MB

MD5
3d254226bd3989d3f1decb11380347f8

SHA1
40e7529f71f5300ac4fa1afb4c4ae3c5173d2b45

SHA256
ce75ee1b1b4c44acb7c59bd5d421bdd68091c8bd5921d75931aabf1b85d3fd48

SHA512
6d6d305abc105ed347746cb16c2c13f7872e334475628e5ee4dfa88a0acb27637aec5cca4e7f2b53ae23da31af7b9b0222a9c7c1f0eb22820d1670aeea587028

Download Submit
memory/1324-13-0x00000000010D0000-0x00000000010E5000-memory.dmp

Filesize
84KB

Download
memory/1324-10-0x00000000010D0000-0x00000000010E5000-memory.dmp

Filesize
84KB

Download
memory/1324-15-0x00000000010D0000-0x00000000010E5000-memory.dmp

Filesize
84KB

Download
memory/1324-16-0x00000000010D0000-0x00000000010E5000-memory.dmp

Filesize
84KB

Download
memory/1324-17-0x00000000010D0000-0x00000000010E5000-memory.dmp

Filesize
84KB

Download
memory/1828-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1828-1-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/1828-0-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/1828-8-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2220-6-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2220-9-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2220-14-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2220-7-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads