7063c158e7c44e762fa199822d3db69e4b9c972b48fb2dffb07394e06834181f

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Size 2.4MB
Sample261014-ez3eksfw2t
SHA256 7063c158e7c44e762fa199822d3db69e4b9c972b48fb2dffb07394e06834181f
MD5 e7dbd5fc591fa6f01d3be18323761d1c
SHA1 2f19e3e928c7202622346209c0252ac49db032ed
SHA512 87c2e0805e6128c99bf833ce87158d9112c89d17edcea0e1359f9c68ec5ba613749f78539dc9aa27f0697b18cfb37e3ec5fb324bb8aed12717b544f9b74e9b4e
SSDEEP 24576:JMFoxPls+QvEOAXX0wqn+Ux2OQCe5cqngmsbypTO9MgC3+rEZ:JMFMPnQvEOyqjHQ1miTOPk
TLSH
T174B512197642D195E4B69AFE4B73A3D9879C6C65AE60C48332C03F4E11BD0C3BE19F92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	856	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
Token: SeLoadDriverPrivilege	856	jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Win32.DownloadHelper.gen.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:856