Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 11:09
Static task
static1
Behavioral task
behavioral1
Sample
05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe
-
Size
5.3MB
-
MD5
05730af4dc030ac093a945e2912be8cd
-
SHA1
cea6918c3899d59d2098b6be893ec9865952e0b6
-
SHA256
9b663d324d3316df0866ab8c0f86371a71399399672fbfa4a50410d367787e8b
-
SHA512
67f42ed04b1c411a1321b166d44af1180eab0078bae766bb4695dad2de2a713c97831121aa93977c1b8fd61a0535f1d63b13ff0707e68421efda78c34bab7f14
-
SSDEEP
6144:7/m9kF4LhB959Ak24Fa8yVRasuSuvfQ1dskAsaJraBCDorAB:bfFWB9bpFatVMPfgsVpraB
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1580-5-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/1580-8-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/1580-16-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/1580-26-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/1580-29-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2836 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/3060-13-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/3060-19-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/3060-17-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/3060-15-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/3060-18-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/3060-24-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exevbc.exedescription pid process target process PID 1720 set thread context of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1580 set thread context of 3060 1580 vbc.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 1580 vbc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exevbc.execmd.exedescription pid process target process PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1720 wrote to memory of 1580 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1580 wrote to memory of 3060 1580 vbc.exe vbc.exe PID 1720 wrote to memory of 2836 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe cmd.exe PID 1720 wrote to memory of 2836 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe cmd.exe PID 1720 wrote to memory of 2836 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe cmd.exe PID 1720 wrote to memory of 2836 1720 05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe cmd.exe PID 2836 wrote to memory of 2592 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 2592 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 2592 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 2592 2836 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\wnNceCpYIE.ini"3⤵PID:3060
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\05730af4dc030ac093a945e2912be8cd_JaffaCakes118.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3