3c095f96c2465776c58a04b1a729fb2a649693d51c87eca680009bf1c66db2b9

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Size 1.9MB
Sample261014-e1jnvsv12q
SHA256 3c095f96c2465776c58a04b1a729fb2a649693d51c87eca680009bf1c66db2b9
MD5 f0dde10b382e10ebbf02e1ff81e0f8ca
SHA1 b90fc4c18bfc27c8577b0866677a555eeed17808
SHA512 966c5a5e5381164b9a766770f6fdb33e7fe5a97e0ad66ec73826a718abc28c12c64ac53540d9a123fe19b95dbccce1bf49090acfc36e58ce834fb0a4a32211d1
SSDEEP 24576:CYVTEaQgIU0R6Y910HBrQkmL7thPohNhFMhFkaH:CYVQHR1/+BrQvtcqv
TLSH
T175951222B2E4C036E8B256F55CB5C57B01B47D662A64488733C23F2B7A752D3E325F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4728	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4728