e98675efac263658b63e851a349aa40e474c7fed82d36f8dd6aa3e8443f0ad03

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Size 2.1MB
Sample261014-evcclayta1
SHA256 e98675efac263658b63e851a349aa40e474c7fed82d36f8dd6aa3e8443f0ad03
MD5 7488828e019d82a44457296f669e47e1
SHA1 0329dcf9179fa38e08677a709be1d9ab88beb5c3
SHA512 12f1ee545bf48cd3b9ecf8872a485bcbc01969825353e23fe0e79f81baac32ca7c61b79dea1ed3e477a74dcd46c1546b76272c6897ea8630992faef102ea47bb
SSDEEP 12288:+u6h8AroOGYqV7GECe7rNMSmmFrbyYL5kLpK5I5pnieHoeVqVPFMSQ01noOECk:+Jh8Aro7vB37BMTmNO69ebP8PWSeO
TLSH
T1DBA5231033D3C1B5E8E757F6269A831595A43F228A3449C733E41F2E1A742E7693AF63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1688	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1688