3915074461517b9ff13676c47b56f2d0a4fbb33dd5e2b9747619927f9be915c1

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.dll
Size 60KB
Sample261014-dev94aex5s
SHA256 3915074461517b9ff13676c47b56f2d0a4fbb33dd5e2b9747619927f9be915c1
MD5 4d02ab3a0000f0ab6769bcf965a710c9
SHA1 63d8036074b8af0c7216a265ea8560e0a4d21b89
SHA512 540d2b2190c1ac4f9c325e96ecef11e8648c7a47198e03513e113033c28f7d0b21e47181e79d568ce1706d96ea3d6298dff9a19f730dba4dbcf269620f9354f4
SSDEEP 1536:kWbGCqgVU3yHz/wdz7UE/sTBH3PLujd7h7:kufY6k2E/mDu5F7
TLSH
T1705301B13364999AE00513FC96713F71496ADD0C2BB30843CC8B8DDA86ED17A6617F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\System Photo Imager = "RunDll32 \"C:\\Windows\\system32\\km-KH\\srvperf.dll\",Init"	rundll32.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cy-GB\lsaperf.dll	rundll32.exe
File created	C:\Windows\SysWOW64\et-EE\etuphost.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\et-EE\etuphost.dll	rundll32.exe
File created	C:\Windows\SysWOW64\km-KH\srvperf.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\km-KH\srvperf.dll	rundll32.exe
File created	C:\Windows\SysWOW64\cy-GB\lsaperf.dll	rundll32.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	rundll32.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	rundll32.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunDll32.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	rundll32.exe
Key created	\REGISTRY\MACHINE\HARDWARE\Description\System\MultifunctionAdapter\0\DiskController	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2352	rundll32.exe
2352	rundll32.exe
2352	rundll32.exe
2352	rundll32.exe
2352	rundll32.exe
2352	rundll32.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 2352	4436	rundll32.exe	87
PID 2352 wrote to memory of 4492	2352	rundll32.exe	89
PID 2352 wrote to memory of 2508	2352	rundll32.exe	44
PID 2352 wrote to memory of 3160	2352	rundll32.exe	47
PID 2352 wrote to memory of 3484	2352	rundll32.exe	50
PID 2352 wrote to memory of 3572	2352	rundll32.exe	57
PID 2352 wrote to memory of 4352	2352	rundll32.exe	59
PID 2352 wrote to memory of 4424	2352	rundll32.exe	60
PID 2352 wrote to memory of 4456	2352	rundll32.exe	61
PID 2352 wrote to memory of 4760	2352	rundll32.exe	63
PID 2352 wrote to memory of 5000	2352	rundll32.exe	64
PID 2352 wrote to memory of 5180	2352	rundll32.exe	65
PID 2352 wrote to memory of 5288	2352	rundll32.exe	66
PID 2352 wrote to memory of 3988	2352	rundll32.exe	78
PID 2352 wrote to memory of 2872	2352	rundll32.exe	79
PID 2352 wrote to memory of 4420	2352	rundll32.exe	80
PID 2352 wrote to memory of 2116	2352	rundll32.exe	81
PID 2352 wrote to memory of 4164	2352	rundll32.exe	82
PID 2352 wrote to memory of 4436	2352	rundll32.exe	86
PID 2352 wrote to memory of 4492	2352	rundll32.exe	89

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3160

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3572

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4456

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4760

C:\Windows\system32\ctfmon.exe
/QuitInfo:000000000000026C;0000000000000270;
1⤵
PID:5000

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5180

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5288

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3988
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2872
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll,#1
      4⤵
      Adds Run key to start application
      Drops file in System32 directory
      Event Triggered Execution: Netsh Helper DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\SysWOW64\RunDll32.exe
        
        RunDll32 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.dll",Init
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4492

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:4420

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2116