Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 11:04

General

  • Target

    222386d52df00ece988740b592c4d035_JaffaCakes118.exe

  • Size

    225KB

  • MD5

    222386d52df00ece988740b592c4d035

  • SHA1

    3f54f12c9d0c5cbdee07d44638845224bd0ba80a

  • SHA256

    c970ead0023376ae7d13d55f16e7242b04efce55ddb923acece5ef254f2b3492

  • SHA512

    ab28b3af691b7f716669159d11d0eeaeeba58effa605901023ae860cbd64ad06dff77691d0450debe8b4b08d85f6a10c84730b929b6c7c1d085acb38582bc887

  • SSDEEP

    6144:KlaAyIAWVT/c770ecOaCKWHVBwF8I8cUHI+3XIfwPG:KASTVbc770C/KWAFT8c0HOw

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\222386d52df00ece988740b592c4d035_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\222386d52df00ece988740b592c4d035_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f1df31792be59c882258fe79f588e5b0

    SHA1

    527285249fa0a7d97e613da0c04e52b4a6fbb929

    SHA256

    04ee41f894a115c7cb100d00fd2443b3f681a3c5b932ae66f2a71f07170b2f79

    SHA512

    e2cc017f9f57e2a5089c2526141b317599eb7e434b56ddf1a2ec95ddf52b638bbeaa3129e15784f633c2c0083869b60fa3659aafbeb686510fc8495dc36db6bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    164face66b3e3f3dec04a09f230abf23

    SHA1

    775c026933532e97202dede4ebfabed284356cba

    SHA256

    068e6615ad9c9cc28640a9da4d0b29d66b7d3d49b95901c0d3a72701e69a5801

    SHA512

    8d0737d5721a62729c10041d5c372fdc29035bb92e591bb9cd3534e1e0028fbbc687c253447254270dd1e9606718a00d4c8e10ec68d036e2473ab2c690405259

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ccde4f503ec122052ec6a634b73be25c

    SHA1

    791db88d1f3294e0b1b3e38e42701d161d24d964

    SHA256

    e9e972c9a6ada1a1845fc2d530f8cada8092f69060eae0cd26f87bd2ce4c0aad

    SHA512

    17f3e1915b81680d862215a078b33c1021ae6e06c28472b310a4058a67a42f1248695194d2287d326ab58c3f1eb1608c5246d486201eddee7310af0446eb8a7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    407d7878bbbbfa566ff900010d2dcdd2

    SHA1

    bd434f06884a4057e03f4f3cf1bc07804022e055

    SHA256

    95ab6c89c1109e2742ecd87d741a61c748d4f68d6c0d02144f417032f163d14a

    SHA512

    1c372efdbdcd2e9852a3478a6fa1506e4dd60bc26227b77e7a5c2e79461f38bc820411070c611fcfe048fcb5ddf2d5913ad7418832da6081994ca0a5f762749f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eba44fcc02bee97e569065951f995912

    SHA1

    0140401b0ae9c722e7fa04aedaadddb185303b92

    SHA256

    11a4bf12285a4c6a29bd96eb2cc25fa3ac26feafe690c9db5d3bb286b5f37600

    SHA512

    29cf0d181f1581844f645f1edd0d8a27ad894ec8100c98cb79ebf8241d201c5d264af638fbc68790f9d85b7b66ccca97e6f71867debeb6af684de26cf43fd7f2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f6710f2572c11919a2d21391610ec8e6

    SHA1

    c4515f0f3625afb3e24dc2345b748552f30ed496

    SHA256

    56606110107ab3d6ae0cdd26c7832c36ef2c3086d7499421994484b31e0061e2

    SHA512

    2cb32e2167ff81be8d22e8b2bef6d84a98032d99d71cebba1ac7f3236f78e9e0e524a27116bbf7f130639c002542ea11df5e7fe5b13e5d5ac7f6312b6f79b550

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    29b7d08d39a578d460257cf7f54d855b

    SHA1

    5d7aa2867cc467312577969a0e70759a69c5d5a6

    SHA256

    68393676835e92c14d1b67f4206528cca1c57b31617937781778932b96fbb334

    SHA512

    29b2967d22dc4906a099ac4b9a9ffac5a6d012222fae30cd3921453fb4782e7c0e723f576a139449647ab9fe6525c8bba4c1bafb05b3f1d8fa0754a21ff25890

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    effae668be032177550649770e83a638

    SHA1

    6b81fea740e8f13d5fa49cd5b6d82971e03e2048

    SHA256

    d7ba3aef93a3498c94e90e29c6fe78e06886cedfab1fdc464cff093d621b31b2

    SHA512

    03e641a41332445b9f13cfbbefad2a0a182e3df1fdb1e84ce99d30f729cad8d39ca8b6bd1edb6acfd6d014cf7aae84b460ac3fd1d5fb82744058cf004253bfda

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    937f80a66c1709cc48f4d8a1f76025f1

    SHA1

    8fd6621e3849f37991efe8ce62c865a9c145a6f4

    SHA256

    222b985816472e8ddbfc56819c055ab7cda46c7778ab956bb6ac55ac99f775ca

    SHA512

    6047840cdd0774cce8b7e9d400764d828ca3b961ad56c958dd59541f0e2bb7724d984c8cc604592fcad41a312d4634f7eaee24caf7769ec380a1efda9b1be528

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e6b36c334ad9ccbd21639b4ff95c2930

    SHA1

    4e3dbf209cdc478523704198f73b7a629a7a9f4d

    SHA256

    ffad062256ef5d378666adff681c7f1b200445e73aa2c2f55d2c336e1eafa7fc

    SHA512

    d0a69de4288d1b6c5ca8aaa3041f603ce2d262d763b8304dfcc18fc3595f3a07b51ea732d86e3a2b7fb3789bd8d8bffff63b1b3c678956e02a32ddfd8ae2f48b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4f077c47ce8867e397fdc4ab42d33655

    SHA1

    c97335b6207e14039f9135ef010cbc61c5da56c6

    SHA256

    df66d474f7f9f81b1ab924174ec6cc8cf11f43e2d4a5d4f387e07b59e3639eab

    SHA512

    7caed1d87625f293f5a3256181d5f8fd3ebd81fc4216c53492eb2f86da9b52546123851005a0582319075661845a52336b99a38e063eb00b7bc3cba26614850f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e1ba2e4c2107659becd20b8e4e441c76

    SHA1

    5bab7584a6108374a2786c12f730dc17faabacf2

    SHA256

    07c22466aeaec82353bd92ed59ecafa39b2e169ee575844419c6600c6dfc7b18

    SHA512

    fe48d48a2f831aa3eb6a3877d3fada0a4646dab9942a318e857c1cede5784a94074701c7de9380a68fd4e5298f387c14ba9bd8158e2f1eb7435fe7cb2f10330c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d51f733f0cd43216d441fcba9e26c88

    SHA1

    fcfe14432efc4ea0a0b35b3c3d902738ea592651

    SHA256

    2d5342f19b63be4fb56f1fcca363851dc0ff8ef7c23882f1151935a79b750221

    SHA512

    3ce797f35e8d88f5cda31dc86a89b468a82e76c042c7bb90d61f3bb88c10096f376363e92d6a289457768e10449158aa76998cd3195eaec17dd798ce02b59983

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    35c06a568925246ea6b8ca22733a5fe9

    SHA1

    5b38ab64291ad7cd1c2d9919eb9029569a35fc55

    SHA256

    fbb5e1a938d39c1479c88364750cc8fafb133ab44ab2e54fd9c1abd544acf8c4

    SHA512

    1b1df6e0f8aed0fc645dc5055aeddf1a679fd597220b1feeaef576608279d1ad399e31f0676ef2ff72d7f2a210c32bdbb214bcfb6a15946462deb2c6663209b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    23c4042c2f1b8891ee5095a7659015e8

    SHA1

    0e5eb01ad5061f24097b8eed958e0caad4feaf08

    SHA256

    e71f6557e55998f5a430501c38ceb94dbf2ea2ae7f8fe11011f7b0e0c656fc12

    SHA512

    b57910a913d07164ef9ccbdf86b5e35701df927c409db45ffbf6bfdaaef66e1debfa2d704801c90abb930f479e402c5bfc6d19f89cf9e09ba5eac4259f457006

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b5ae5654a4b5f6d19b08bb2dd57961d0

    SHA1

    f18fec7b782dd658eb4d22c7c7e690884308f8cf

    SHA256

    b993f8e02faed9f455d607b9ecef4bb2cf7cf0e58a1297d135feaf0089e35f41

    SHA512

    7d84ccd00ac10b569284ca71be7f2dc5efb1e6b436aa0d25f1dc69fef913122e100cf13090d753631c7d87e83752a2636cd7ae6059606aa7707c00fbad9f630b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    879a180bdd76b6cd57084586491d20a1

    SHA1

    44f4e99cb0034403aa1af00e9a073af231876c5d

    SHA256

    cc02646c64e2a00aa1c0b3c2ec4a18f51eb8249e5ce68db4dcd95e24921a1dee

    SHA512

    cd30f9cf47dbffce39d875aad80d4bb7e4389d2fecb13e04d331fcf0d32948387439b3aebd824803b92ab031bee5969ee6c8e570e3ed9ce6d238e5553fcc387d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4d1e812f3228dfae3dd80cef1a7e8cc6

    SHA1

    ee2a60f9e74febc283c44d04b25456577a873792

    SHA256

    9c5f5a44f18a005fdb571506ebfc1ff1e6434e4cbb90d9b04eda97bdc02fb57e

    SHA512

    fc6b41c12582057624715cfe42885468538a84dd1b493421f24d1c3569acb947bf41657d5d67ac2c5d68a66861b089627ec3b6cf503308c90fe675e37a08f61e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3dfa7062d8a8ae0993016dae18ca7f95

    SHA1

    e9bc89057f51638cdc020b9d5621cfd1f4d13d4d

    SHA256

    f21bf2f2e1a61e80d9ae1faeddeae1ff3fe39cb6001bc3c2d98000f96f061e49

    SHA512

    d4f21fa257757664b765ec424c792d741ee6065299712f7eeeaa563f60568c031295121a16513e14329c990e62a7f673fa9ea1239fa2a272c351eda029d86a7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e8fc2e003e05eeb0cbe4637c5443161d

    SHA1

    ad261317c132c39c15b26463997765e38e582279

    SHA256

    99c265a9bf418df5c00864c1bbce39ff0d14553e51e8bcd7fbdc4a67d9df287d

    SHA512

    bd924374109e5e206da0ca7d66b8bb470a491a1ca3a0df747ae5fdc80df63206a909cb7c257e1c4d88672c88f61695f41d42ffe815489b48d4fe8f36339119db

  • C:\Users\Admin\AppData\Local\Temp\Cab57A5.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar5828.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2388-0-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB