908db5ff1e431ac3235f9e683c07a457f1bbc8281d44de7a240a5d8b1623bf2f

General

Target
jaffacakes118_Trojan.Win32.Inject.ahwba.exe
Size 7.9MB
Sample261018-wtcemsfx2k
SHA256 908db5ff1e431ac3235f9e683c07a457f1bbc8281d44de7a240a5d8b1623bf2f
MD5 1b3576dbff637e1ce7c746b70da1e79e
SHA1 fa736f34e8d383fa4b4f9a47090e77576daf6613
SHA512 e0e6882110f1279f2f491e7f8520905668fb2d10fa93b3e5e9bdca7d88d335ca0798b77cb0a078830ee9a74048740af5d57590f25437dd214d8bd9a7355bd8ac
SSDEEP 98304:WHcZwh+ULzxHoLEhbFoO+E4d+bxqzAYmzMCSEo8:Ih7LzxHoLE1FiEXgAYSMCPd
TLSH
T1ED86E16651CAE63EC457073A04A3A1118F3E6F581517DC57A9F98EACCF3A48031BA7CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	jaffacakes118_Trojan.Win32.Inject.ahwba.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5968 set thread context of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	jaffacakes118_Trojan.Win32.Inject.ahwba.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan.Win32.Inject.ahwba.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Inject.ahwba.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe
976	jaffacakes118_Trojan.Win32.Inject.ahwba.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89
PID 5968 wrote to memory of 976	5968	jaffacakes118_Trojan.Win32.Inject.ahwba.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwba.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwba.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwba.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Inject.ahwba.exe"
  2⤵
  - Maps connected drives based on registry
  - Direct Volume Access: Opens a physical disk for reading
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:976