Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15-07-2024 12:06
Static task
static1
Behavioral task
behavioral1
Sample
49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe
-
Size
5.2MB
-
MD5
49b4d87aef4bb0a3f925860147b6bdc1
-
SHA1
857237fb27953167c1ec8ee01666a3920100ef02
-
SHA256
1d03f8df088e33d558094c363d8e499557e7f96f3d31f699f776db61c29fb255
-
SHA512
ffa4c7e4592b1434f389e229175cc88b9455a07507c80bf38e9f9ae1c8d9b9db40f1d184a4180e99607c8062693327ac445a67828e81bc96fe7503f93c6a70ad
-
SSDEEP
6144:7/m9kF4LhB959Ak24Fa8yVRasuSuvfQ1dskAsaJraBCDorAB:bfFWB9bpFatVMPfgsVpraB
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral2/memory/3568-3-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral2/memory/3568-5-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral2/memory/3568-19-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral2/memory/3568-23-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe -
resource yara_rule behavioral2/memory/620-8-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/620-10-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/620-11-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/620-15-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3604 set thread context of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3568 set thread context of 620 3568 vbc.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3724 PING.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3568 vbc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3604 wrote to memory of 3568 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 84 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3568 wrote to memory of 620 3568 vbc.exe 85 PID 3604 wrote to memory of 4552 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 86 PID 3604 wrote to memory of 4552 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 86 PID 3604 wrote to memory of 4552 3604 49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe 86 PID 4552 wrote to memory of 3724 4552 cmd.exe 88 PID 4552 wrote to memory of 3724 4552 cmd.exe 88 PID 4552 wrote to memory of 3724 4552 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe/scomma "C:\Users\Admin\AppData\Local\Temp\uNBYm2dEwI.ini"3⤵PID:620
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\49b4d87aef4bb0a3f925860147b6bdc1_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:3724
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3