5918150353c5b0be5357250c81aae2a8ada0ea8c4a05f20f9f58cfd301fb8117

General

Target
jaffacakes118_Trojan.Win32.Inject.ahwau.exe
Size 7.9MB
Sample261018-wtaaaafw9q
SHA256 5918150353c5b0be5357250c81aae2a8ada0ea8c4a05f20f9f58cfd301fb8117
MD5 27d254795a51a1977d22a81f943e94a6
SHA1 59a89ce22dafb4c5f7a18ff65bfd092657a58d18
SHA512 192275084e4426db917cf9e0251636125ce68b4776ccf61fb7c67c2a2de9fc46287b49c6192ba84186a20d0391ca456620bc132ce6e3c95e798333106b2423c5
SSDEEP 98304:yHcZwh+UmlSlfHZ74PnPRpvMVte8nffCuCiu+XXmDCp3lr+Ip2jm:0h7mQlfHZQPRpvMFiuC6cCH/V
TLSH
T15D86E03650CAE53FC49B073A04A7A1118F3E6F581117DC5799F98EAC8E7A54031BA78F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	jaffacakes118_Trojan.Win32.Inject.ahwau.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3456 set thread context of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	jaffacakes118_Trojan.Win32.Inject.ahwau.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan.Win32.Inject.ahwau.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ahwau.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe
2276	jaffacakes118_Trojan.Win32.Inject.ahwau.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89
PID 3456 wrote to memory of 2276	3456	jaffacakes118_Trojan.Win32.Inject.ahwau.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwau.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwau.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwau.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwau.exe"
  2⤵
  - Maps connected drives based on registry
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2276