Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	weimachel.net	udp
US	8.8.8.8:53	ip-api.com	udp
US	208.95.112.1:80	ip-api.com	tcp

Files

memory/2484-1-0x0000000002940000-0x0000000002A40000-memory.dmp

memory/2484-2-0x0000000003E40000-0x0000000003ECB000-memory.dmp

memory/2484-3-0x0000000000400000-0x000000000048F000-memory.dmp

memory/2484-4-0x0000000000400000-0x00000000024F9000-memory.dmp

memory/2484-14-0x0000000003E40000-0x0000000003ECB000-memory.dmp

memory/2484-13-0x0000000002940000-0x0000000002A40000-memory.dmp

memory/2484-12-0x0000000000400000-0x00000000024F9000-memory.dmp

memory/2484-15-0x0000000000400000-0x000000000048F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-15 12:20

Reported

2024-06-15 12:22

Platform

win10v2004-20240611-en

Max time kernel

141s

Max time network

113s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe"

Signatures

Vidar

stealer vidar

Vidar Stealer

stealer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Reads local data of messenger clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses 2FA software files, possible credential harvesting

spyware stealer

Checks installed software on the system

discovery

Looks up external IP address via web service

Description	Indicator	Process	Target
N/A	ip-api.com	N/A	N/A

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\ae65dcd1d52b59918c124adc247131f5_JaffaCakes118.exe	N/A