tofsee | 96946f52a7f820fe8904eb72f1e41b434e0139de8b2af99e51cb6b0b6dd89ac8

General

Target

JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe
Size

11.1MB
MD5

eb79e351abac2662239b0b6c141d6ea1
SHA1

cf3b72eea6b5b9478da32a5a3b4c9efb2b460b66
SHA256

96946f52a7f820fe8904eb72f1e41b434e0139de8b2af99e51cb6b0b6dd89ac8
SHA512

6a76d601c61f14f4afa8105b0c3ea064379584d2d9331a6c0863adc13641aeccd111af21881f8aff3b70d3566793df6121a44a90288b16a231c9fea9af83d27a
SSDEEP

49152:89GbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGbGn:

Score

10^/10

tofsee discovery evasion execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Signatures

Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Tofsee family
tofsee
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1200	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dmocnfew\ImagePath = "C:\\Windows\\SysWOW64\\dmocnfew\\uvtdgzep.exe"	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe

Deletes itself 1 IoCs

pid	Process
3448	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1140	uvtdgzep.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 3448	1140	uvtdgzep.exe	98

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4244	sc.exe
692	sc.exe
2260	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
916	1748	WerFault.exe	80
388	1140	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uvtdgzep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1528	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	82
PID 1748 wrote to memory of 1528	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	82
PID 1748 wrote to memory of 1528	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	82
PID 1748 wrote to memory of 3132	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	84
PID 1748 wrote to memory of 3132	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	84
PID 1748 wrote to memory of 3132	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	84
PID 1748 wrote to memory of 4244	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	86
PID 1748 wrote to memory of 4244	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	86
PID 1748 wrote to memory of 4244	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	86
PID 1748 wrote to memory of 692	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	88
PID 1748 wrote to memory of 692	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	88
PID 1748 wrote to memory of 692	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	88
PID 1748 wrote to memory of 2260	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	90
PID 1748 wrote to memory of 2260	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	90
PID 1748 wrote to memory of 2260	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	90
PID 1748 wrote to memory of 1200	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	93
PID 1748 wrote to memory of 1200	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	93
PID 1748 wrote to memory of 1200	1748	JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe	93
PID 1140 wrote to memory of 3448	1140	uvtdgzep.exe	98
PID 1140 wrote to memory of 3448	1140	uvtdgzep.exe	98
PID 1140 wrote to memory of 3448	1140	uvtdgzep.exe	98
PID 1140 wrote to memory of 3448	1140	uvtdgzep.exe	98
PID 1140 wrote to memory of 3448	1140	uvtdgzep.exe	98

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dmocnfew\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\uvtdgzep.exe" C:\Windows\SysWOW64\dmocnfew\
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3132
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create dmocnfew binPath= "C:\Windows\SysWOW64\dmocnfew\uvtdgzep.exe /d\"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4244
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description dmocnfew "wifi internet conection"
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:692
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start dmocnfew
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2260
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 1192
  2⤵
  - Program crash
  PID:916

C:\Windows\SysWOW64\dmocnfew\uvtdgzep.exe
C:\Windows\SysWOW64\dmocnfew\uvtdgzep.exe /d"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eb79e351abac2662239b0b6c141d6ea1.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  - Sets service image path in registry
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 520
  2⤵
  - Program crash
  PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1748 -ip 1748
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1140 -ip 1140
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\uvtdgzep.exe

Filesize
14.7MB

MD5
49e17376c6c211c1887b6b5688eadc35

SHA1
a61a67ddbc871d5f47ab504643c33afdcb0955f2

SHA256
df9418bcff8a91cc2d84d737d2d1d7b3fdec0c852766aa3785b7e5daf9b4311c

SHA512
2c32d10c30e8b789ce6a795ddac26901eaab75908fa597d2c0e201983e3a39913a7282c44e280594409636624f7837a8794840d4ae184178b0b39306a0ce6612

Download Submit
memory/1140-14-0x0000000000400000-0x00000000016BD000-memory.dmp

Filesize
18.7MB

Download
memory/1140-17-0x0000000000400000-0x00000000016BD000-memory.dmp

Filesize
18.7MB

Download
memory/1748-1-0x00000000019B0000-0x0000000001AB0000-memory.dmp

Filesize
1024KB

Download
memory/1748-2-0x0000000001970000-0x0000000001983000-memory.dmp

Filesize
76KB

Download
memory/1748-3-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1748-8-0x0000000000400000-0x00000000016BD000-memory.dmp

Filesize
18.7MB

Download
memory/1748-10-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1748-9-0x0000000001970000-0x0000000001983000-memory.dmp

Filesize
76KB

Download
memory/3448-11-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download
memory/3448-13-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download
memory/3448-15-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads