Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
222386d52df00ece988740b592c4d035_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
222386d52df00ece988740b592c4d035_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
222386d52df00ece988740b592c4d035_JaffaCakes118.exe
-
Size
225KB
-
MD5
222386d52df00ece988740b592c4d035
-
SHA1
3f54f12c9d0c5cbdee07d44638845224bd0ba80a
-
SHA256
c970ead0023376ae7d13d55f16e7242b04efce55ddb923acece5ef254f2b3492
-
SHA512
ab28b3af691b7f716669159d11d0eeaeeba58effa605901023ae860cbd64ad06dff77691d0450debe8b4b08d85f6a10c84730b929b6c7c1d085acb38582bc887
-
SSDEEP
6144:KlaAyIAWVT/c770ecOaCKWHVBwF8I8cUHI+3XIfwPG:KASTVbc770C/KWAFT8c0HOw
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 1 IoCs
resource yara_rule behavioral1/memory/2388-0-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\222386d52df00ece988740b592c4d035_JaffaCakes118 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\222386d52df00ece988740b592c4d035_JaffaCakes118.exe" 222386d52df00ece988740b592c4d035_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1012 set thread context of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DB078A1-392C-11EF-B27B-DA219DA76A91} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426166552" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2388 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2388 iexplore.exe 2388 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 1012 wrote to memory of 2388 1012 222386d52df00ece988740b592c4d035_JaffaCakes118.exe 28 PID 2388 wrote to memory of 2716 2388 iexplore.exe 30 PID 2388 wrote to memory of 2716 2388 iexplore.exe 30 PID 2388 wrote to memory of 2716 2388 iexplore.exe 30 PID 2388 wrote to memory of 2716 2388 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\222386d52df00ece988740b592c4d035_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\222386d52df00ece988740b592c4d035_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1df31792be59c882258fe79f588e5b0
SHA1527285249fa0a7d97e613da0c04e52b4a6fbb929
SHA25604ee41f894a115c7cb100d00fd2443b3f681a3c5b932ae66f2a71f07170b2f79
SHA512e2cc017f9f57e2a5089c2526141b317599eb7e434b56ddf1a2ec95ddf52b638bbeaa3129e15784f633c2c0083869b60fa3659aafbeb686510fc8495dc36db6bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5164face66b3e3f3dec04a09f230abf23
SHA1775c026933532e97202dede4ebfabed284356cba
SHA256068e6615ad9c9cc28640a9da4d0b29d66b7d3d49b95901c0d3a72701e69a5801
SHA5128d0737d5721a62729c10041d5c372fdc29035bb92e591bb9cd3534e1e0028fbbc687c253447254270dd1e9606718a00d4c8e10ec68d036e2473ab2c690405259
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ccde4f503ec122052ec6a634b73be25c
SHA1791db88d1f3294e0b1b3e38e42701d161d24d964
SHA256e9e972c9a6ada1a1845fc2d530f8cada8092f69060eae0cd26f87bd2ce4c0aad
SHA51217f3e1915b81680d862215a078b33c1021ae6e06c28472b310a4058a67a42f1248695194d2287d326ab58c3f1eb1608c5246d486201eddee7310af0446eb8a7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5407d7878bbbbfa566ff900010d2dcdd2
SHA1bd434f06884a4057e03f4f3cf1bc07804022e055
SHA25695ab6c89c1109e2742ecd87d741a61c748d4f68d6c0d02144f417032f163d14a
SHA5121c372efdbdcd2e9852a3478a6fa1506e4dd60bc26227b77e7a5c2e79461f38bc820411070c611fcfe048fcb5ddf2d5913ad7418832da6081994ca0a5f762749f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5eba44fcc02bee97e569065951f995912
SHA10140401b0ae9c722e7fa04aedaadddb185303b92
SHA25611a4bf12285a4c6a29bd96eb2cc25fa3ac26feafe690c9db5d3bb286b5f37600
SHA51229cf0d181f1581844f645f1edd0d8a27ad894ec8100c98cb79ebf8241d201c5d264af638fbc68790f9d85b7b66ccca97e6f71867debeb6af684de26cf43fd7f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f6710f2572c11919a2d21391610ec8e6
SHA1c4515f0f3625afb3e24dc2345b748552f30ed496
SHA25656606110107ab3d6ae0cdd26c7832c36ef2c3086d7499421994484b31e0061e2
SHA5122cb32e2167ff81be8d22e8b2bef6d84a98032d99d71cebba1ac7f3236f78e9e0e524a27116bbf7f130639c002542ea11df5e7fe5b13e5d5ac7f6312b6f79b550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529b7d08d39a578d460257cf7f54d855b
SHA15d7aa2867cc467312577969a0e70759a69c5d5a6
SHA25668393676835e92c14d1b67f4206528cca1c57b31617937781778932b96fbb334
SHA51229b2967d22dc4906a099ac4b9a9ffac5a6d012222fae30cd3921453fb4782e7c0e723f576a139449647ab9fe6525c8bba4c1bafb05b3f1d8fa0754a21ff25890
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5effae668be032177550649770e83a638
SHA16b81fea740e8f13d5fa49cd5b6d82971e03e2048
SHA256d7ba3aef93a3498c94e90e29c6fe78e06886cedfab1fdc464cff093d621b31b2
SHA51203e641a41332445b9f13cfbbefad2a0a182e3df1fdb1e84ce99d30f729cad8d39ca8b6bd1edb6acfd6d014cf7aae84b460ac3fd1d5fb82744058cf004253bfda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5937f80a66c1709cc48f4d8a1f76025f1
SHA18fd6621e3849f37991efe8ce62c865a9c145a6f4
SHA256222b985816472e8ddbfc56819c055ab7cda46c7778ab956bb6ac55ac99f775ca
SHA5126047840cdd0774cce8b7e9d400764d828ca3b961ad56c958dd59541f0e2bb7724d984c8cc604592fcad41a312d4634f7eaee24caf7769ec380a1efda9b1be528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6b36c334ad9ccbd21639b4ff95c2930
SHA14e3dbf209cdc478523704198f73b7a629a7a9f4d
SHA256ffad062256ef5d378666adff681c7f1b200445e73aa2c2f55d2c336e1eafa7fc
SHA512d0a69de4288d1b6c5ca8aaa3041f603ce2d262d763b8304dfcc18fc3595f3a07b51ea732d86e3a2b7fb3789bd8d8bffff63b1b3c678956e02a32ddfd8ae2f48b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54f077c47ce8867e397fdc4ab42d33655
SHA1c97335b6207e14039f9135ef010cbc61c5da56c6
SHA256df66d474f7f9f81b1ab924174ec6cc8cf11f43e2d4a5d4f387e07b59e3639eab
SHA5127caed1d87625f293f5a3256181d5f8fd3ebd81fc4216c53492eb2f86da9b52546123851005a0582319075661845a52336b99a38e063eb00b7bc3cba26614850f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e1ba2e4c2107659becd20b8e4e441c76
SHA15bab7584a6108374a2786c12f730dc17faabacf2
SHA25607c22466aeaec82353bd92ed59ecafa39b2e169ee575844419c6600c6dfc7b18
SHA512fe48d48a2f831aa3eb6a3877d3fada0a4646dab9942a318e857c1cede5784a94074701c7de9380a68fd4e5298f387c14ba9bd8158e2f1eb7435fe7cb2f10330c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56d51f733f0cd43216d441fcba9e26c88
SHA1fcfe14432efc4ea0a0b35b3c3d902738ea592651
SHA2562d5342f19b63be4fb56f1fcca363851dc0ff8ef7c23882f1151935a79b750221
SHA5123ce797f35e8d88f5cda31dc86a89b468a82e76c042c7bb90d61f3bb88c10096f376363e92d6a289457768e10449158aa76998cd3195eaec17dd798ce02b59983
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD535c06a568925246ea6b8ca22733a5fe9
SHA15b38ab64291ad7cd1c2d9919eb9029569a35fc55
SHA256fbb5e1a938d39c1479c88364750cc8fafb133ab44ab2e54fd9c1abd544acf8c4
SHA5121b1df6e0f8aed0fc645dc5055aeddf1a679fd597220b1feeaef576608279d1ad399e31f0676ef2ff72d7f2a210c32bdbb214bcfb6a15946462deb2c6663209b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523c4042c2f1b8891ee5095a7659015e8
SHA10e5eb01ad5061f24097b8eed958e0caad4feaf08
SHA256e71f6557e55998f5a430501c38ceb94dbf2ea2ae7f8fe11011f7b0e0c656fc12
SHA512b57910a913d07164ef9ccbdf86b5e35701df927c409db45ffbf6bfdaaef66e1debfa2d704801c90abb930f479e402c5bfc6d19f89cf9e09ba5eac4259f457006
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5ae5654a4b5f6d19b08bb2dd57961d0
SHA1f18fec7b782dd658eb4d22c7c7e690884308f8cf
SHA256b993f8e02faed9f455d607b9ecef4bb2cf7cf0e58a1297d135feaf0089e35f41
SHA5127d84ccd00ac10b569284ca71be7f2dc5efb1e6b436aa0d25f1dc69fef913122e100cf13090d753631c7d87e83752a2636cd7ae6059606aa7707c00fbad9f630b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5879a180bdd76b6cd57084586491d20a1
SHA144f4e99cb0034403aa1af00e9a073af231876c5d
SHA256cc02646c64e2a00aa1c0b3c2ec4a18f51eb8249e5ce68db4dcd95e24921a1dee
SHA512cd30f9cf47dbffce39d875aad80d4bb7e4389d2fecb13e04d331fcf0d32948387439b3aebd824803b92ab031bee5969ee6c8e570e3ed9ce6d238e5553fcc387d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54d1e812f3228dfae3dd80cef1a7e8cc6
SHA1ee2a60f9e74febc283c44d04b25456577a873792
SHA2569c5f5a44f18a005fdb571506ebfc1ff1e6434e4cbb90d9b04eda97bdc02fb57e
SHA512fc6b41c12582057624715cfe42885468538a84dd1b493421f24d1c3569acb947bf41657d5d67ac2c5d68a66861b089627ec3b6cf503308c90fe675e37a08f61e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53dfa7062d8a8ae0993016dae18ca7f95
SHA1e9bc89057f51638cdc020b9d5621cfd1f4d13d4d
SHA256f21bf2f2e1a61e80d9ae1faeddeae1ff3fe39cb6001bc3c2d98000f96f061e49
SHA512d4f21fa257757664b765ec424c792d741ee6065299712f7eeeaa563f60568c031295121a16513e14329c990e62a7f673fa9ea1239fa2a272c351eda029d86a7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e8fc2e003e05eeb0cbe4637c5443161d
SHA1ad261317c132c39c15b26463997765e38e582279
SHA25699c265a9bf418df5c00864c1bbce39ff0d14553e51e8bcd7fbdc4a67d9df287d
SHA512bd924374109e5e206da0ca7d66b8bb470a491a1ca3a0df747ae5fdc80df63206a909cb7c257e1c4d88672c88f61695f41d42ffe815489b48d4fe8f36339119db
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b