Analysis
-
max time kernel
132s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 13:18
Behavioral task
behavioral1
Sample
JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe
-
Size
656.5MB
-
MD5
d266e6cfb64be1d505c047cbd0f5c7cf
-
SHA1
e472a7d9f94f48b9421ed603c25efbcd420b2910
-
SHA256
89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7
-
SHA512
fd0c470c23bea14fc76fe242a0e02159d829a4d5ecf0c3c7ecf0f0917c1198bc6c7642739f79d088c456521be3f020bc1a9933162d4163f746b5a0a55cedc6c9
-
SSDEEP
49152:Ot4/d5Zu6rTxefPihoa2ZErpQgIsdMfiIqPH1O+KQGZrfzxAB3F:Ot4V/nTgni6PZErpQgkKIK1O+KQi/x4F
Malware Config
Extracted
vidar
2.1
546
https://t.me/misteryworldismyhome
https://t.me/montgomerywavesgetlucky
https://t.me/prokl3hfy
-
profile_id
546
Signatures
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe -
resource yara_rule behavioral1/memory/2204-7-0x0000000000070000-0x00000000006C6000-memory.dmp themida behavioral1/memory/2204-16-0x0000000000070000-0x00000000006C6000-memory.dmp themida -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2204 set thread context of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28 PID 2204 wrote to memory of 1880 2204 JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_89d2b6b2e5ac7898a9d6903157e64e428bbbff7bc36ef2eccb3617b146e525b7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1880
-