quasar | f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	photo_protected.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	$77setup.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	$77setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	$77setup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
3580	photo_protected.exe
1696	$77setup.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000022f3f-6.dat	themida
behavioral2/memory/3580-25-0x0000000000340000-0x000000000240A000-memory.dmp	themida
behavioral2/memory/3580-26-0x0000000000340000-0x000000000240A000-memory.dmp	themida
behavioral2/memory/1696-55-0x0000000000960000-0x0000000002A2A000-memory.dmp	themida
behavioral2/memory/1696-56-0x0000000000960000-0x0000000002A2A000-memory.dmp	themida

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	photo_protected.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	photo_protected.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	photo_protected.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	$77setup.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\$77\$77setup.exe	photo_protected.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3580	photo_protected.exe
1696	$77setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1456	1696	WerFault.exe	96

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3772	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4764	schtasks.exe
3112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4008	powershell.exe
4008	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	photo_protected.exe
Token: SeDebugPrivilege	4008	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 3580	3444	1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118.exe	90
PID 3444 wrote to memory of 3580	3444	1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118.exe	90
PID 3444 wrote to memory of 3580	3444	1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118.exe	90
PID 3580 wrote to memory of 4764	3580	photo_protected.exe	94
PID 3580 wrote to memory of 4764	3580	photo_protected.exe	94
PID 3580 wrote to memory of 4764	3580	photo_protected.exe	94
PID 3580 wrote to memory of 1696	3580	photo_protected.exe	96
PID 3580 wrote to memory of 1696	3580	photo_protected.exe	96
PID 3580 wrote to memory of 1696	3580	photo_protected.exe	96
PID 3580 wrote to memory of 4008	3580	photo_protected.exe	97
PID 3580 wrote to memory of 4008	3580	photo_protected.exe	97
PID 3580 wrote to memory of 4008	3580	photo_protected.exe	97

C:\Users\Admin\AppData\Local\Temp\1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Users\Admin\AppData\Local\Temp\photo_protected.exe
  "C:\Users\Admin\AppData\Local\Temp\photo_protected.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "drivers" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\photo_protected.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- - C:\Windows\SysWOW64\$77\$77setup.exe
    "C:\Windows\SysWOW64\$77\$77setup.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1696
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "drivers" /sc ONLOGON /tr "C:\Windows\SysWOW64\$77\$77setup.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vYOuRYzIBcUV.bat" "
      4⤵
      PID:3832
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2748
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:3772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 2240
      4⤵
      Program crash
      PID:1456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1696 -ip 1696
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

3

Remote System Discovery

T1018

System Information Discovery

4

Virtualization/Sandbox Evasion