3915074461517b9ff13676c47b56f2d0a4fbb33dd5e2b9747619927f9be915c1

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 60KB
Sample261014-dev94aex5s
SHA256 3915074461517b9ff13676c47b56f2d0a4fbb33dd5e2b9747619927f9be915c1
MD5 4d02ab3a0000f0ab6769bcf965a710c9
SHA1 63d8036074b8af0c7216a265ea8560e0a4d21b89
SHA512 540d2b2190c1ac4f9c325e96ecef11e8648c7a47198e03513e113033c28f7d0b21e47181e79d568ce1706d96ea3d6298dff9a19f730dba4dbcf269620f9354f4
SSDEEP 1536:kWbGCqgVU3yHz/wdz7UE/sTBH3PLujd7h7:kufY6k2E/mDu5F7
TLSH
T1705301B13364999AE00513FC96713F71496ADD0C2BB30843CC8B8DDA86ED17A6617F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Canvas = "RunDll32 \"C:\\Windows\\system32\\upetsvc.dll\",Init"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\upetsvc.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\upetsvc.dll	rundll32.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Java\Java Update\hostmsms.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\hostmsms.dll	rundll32.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\srvlsa.dll	rundll32.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\srvlsa.dll	rundll32.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	rundll32.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunDll32.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe
4176	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 4176	1724	rundll32.exe	85
PID 4176 wrote to memory of 2432	4176	rundll32.exe	93
PID 4176 wrote to memory of 2908	4176	rundll32.exe	50
PID 4176 wrote to memory of 2972	4176	rundll32.exe	51
PID 4176 wrote to memory of 2892	4176	rundll32.exe	52
PID 4176 wrote to memory of 3288	4176	rundll32.exe	56
PID 4176 wrote to memory of 3404	4176	rundll32.exe	57
PID 4176 wrote to memory of 3596	4176	rundll32.exe	58
PID 4176 wrote to memory of 3692	4176	rundll32.exe	59
PID 4176 wrote to memory of 3756	4176	rundll32.exe	60
PID 4176 wrote to memory of 3836	4176	rundll32.exe	61
PID 4176 wrote to memory of 3980	4176	rundll32.exe	62
PID 4176 wrote to memory of 4540	4176	rundll32.exe	65
PID 4176 wrote to memory of 1096	4176	rundll32.exe	75
PID 4176 wrote to memory of 1724	4176	rundll32.exe	84
PID 4176 wrote to memory of 2424	4176	rundll32.exe	87
PID 4176 wrote to memory of 1384	4176	rundll32.exe	88
PID 4176 wrote to memory of 2432	4176	rundll32.exe	93

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2972

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2892

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3288
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
    3⤵
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Event Triggered Execution: Netsh Helper DLL
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Windows\SysWOW64\RunDll32.exe
      RunDll32 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll",Init
      4⤵
      System Location Discovery: System Language Discovery
      PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3596

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3756

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4540

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1096

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

2

T1546

AppInit DLLs

1

T1546.010

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

2

T1546

AppInit DLLs

1

T1546.010

Netsh Helper DLL

1

T1546.007

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hostmsms.dll

Path C:\Program Files (x86)\Common Files\Java\Java Update\hostmsms.dll
Size 60KB
SHA256 3915074461517b9ff13676c47b56f2d0a4fbb33dd5e2b9747619927f9be915c1
MD5 4d02ab3a0000f0ab6769bcf965a710c9
SHA1 63d8036074b8af0c7216a265ea8560e0a4d21b89
SHA512 540d2b2190c1ac4f9c325e96ecef11e8648c7a47198e03513e113033c28f7d0b21e47181e79d568ce1706d96ea3d6298dff9a19f730dba4dbcf269620f9354f4
SSDEEP 1536:kWbGCqgVU3yHz/wdz7UE/sTBH3PLujd7h7:kufY6k2E/mDu5F7
TLSH
T1705301B13364999AE00513FC96713F71496ADD0C2BB30843CC8B8DDA86ED17A6617F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-12-0x00000000014C0000-0x00000000014C1000-memory.dmp

Download

memory/2432-11-0x00000000014C0000-0x00000000014C1000-memory.dmp

Download

memory/4176-0-0x0000000075700000-0x0000000075723000-memory.dmp

Download

memory/4176-2-0x0000000075700000-0x0000000075723000-memory.dmp

Download

memory/4176-1-0x000000007570A000-0x000000007570B000-memory.dmp

Download

memory/4176-3-0x0000000075700000-0x0000000075723000-memory.dmp

Download

memory/4176-13-0x0000000075700000-0x0000000075723000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads