c4525733a9279d5e5375473ec2d8c0ddfc9f6de54d667f868f6948e61eb93000

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Size 2.1MB
Sample261014-ewxd6af12m
SHA256 c4525733a9279d5e5375473ec2d8c0ddfc9f6de54d667f868f6948e61eb93000
MD5 95f096e28bf4a980912b8f18f4ec5e5f
SHA1 02f77dbf55fdfb793bdbd3cc59236c67b2a06520
SHA512 d7d38c4495170df2616401a72a8048c07f77b0f2a7c252893b896223406c5e9650cf4f878edd85c32c03c7d4afb0c5c39436c781609760b3ce623c264f464970
SSDEEP 24576:YBSdaVAkP5PTNTu2uSxWTbajS0pZ1Ipa7R1nmrwgBnjdjK1:YBSYVAcurSjSk4c1Uwg9dM
TLSH
T16DA512013686E262DA5B8BF108EAC015656E3C1DB970779732CBFF8D26701B3D919F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	2120	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2120