Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/01/2025, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe
-
Size
368KB
-
MD5
7b3ff7f2f522779c5bd0cc9862190210
-
SHA1
efbbee045ba78058f6735a472343fe9748834be8
-
SHA256
dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9
-
SHA512
ca3acc3d41a819fb37fd7a37c27fb19250846f5174c4d132e8d4e9f30caaa84aa3405d8c65cafba08328b1c11c445d28136de5bca934aee10156304b43ecf9b6
-
SSDEEP
6144:bYXlu7PKTgM8jlcud0oTPP/eqTNYDWyys9YIusnowR/gVxoCiLXcisNC79FPQ2Hx:2rTgM8j6QxNpyVY6/gV8F
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 5 IoCs
resource yara_rule behavioral1/memory/1236-320-0x0000000000400000-0x0000000000459000-memory.dmp family_isrstealer behavioral1/files/0x002e000000019203-331.dat family_isrstealer behavioral1/memory/1236-381-0x0000000000400000-0x0000000000459000-memory.dmp family_isrstealer behavioral1/memory/968-641-0x0000000000400000-0x0000000000459000-memory.dmp family_isrstealer behavioral1/memory/968-702-0x0000000000400000-0x0000000000459000-memory.dmp family_isrstealer -
Isrstealer family
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\ Host.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\StubPath = "'C:\\Users\\Admin\\AppData\\Roaming\\Host.exe'" Host.exe -
Executes dropped EXE 9 IoCs
pid Process 2988 Host.exe 2136 BVGBV.exe 900 BVGBV.exe 2832 BVGBV.exe 968 Host.exe 2472 Host.exe 2944 VQAVQ.exe 3028 VQAVQ.exe 2092 VQAVQ.exe -
Loads dropped DLL 16 IoCs
pid Process 2300 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 2300 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 2136 BVGBV.exe 900 BVGBV.exe 968 Host.exe 968 Host.exe 968 Host.exe 968 Host.exe 968 Host.exe 2944 VQAVQ.exe 3028 VQAVQ.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Samadbond = "C:\\Users\\Admin\\AppData\\Roaming\\Host.exe" Host.exe -
Suspicious use of SetThreadContext 8 IoCs
description pid Process procid_target PID 2712 set thread context of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 set thread context of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2136 set thread context of 900 2136 BVGBV.exe 34 PID 900 set thread context of 2832 900 BVGBV.exe 35 PID 2988 set thread context of 968 2988 Host.exe 36 PID 2988 set thread context of 2472 2988 Host.exe 37 PID 2944 set thread context of 3028 2944 VQAVQ.exe 39 PID 3028 set thread context of 2092 3028 VQAVQ.exe 40 -
resource yara_rule behavioral1/memory/1236-320-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/1236-381-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/968-641-0x0000000000400000-0x0000000000459000-memory.dmp upx behavioral1/memory/968-702-0x0000000000400000-0x0000000000459000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVGBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQAVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQAVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVGBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BVGBV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VQAVQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2136 BVGBV.exe 2136 BVGBV.exe 2136 BVGBV.exe 2136 BVGBV.exe 2944 VQAVQ.exe 2944 VQAVQ.exe 2944 VQAVQ.exe 2944 VQAVQ.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 2136 BVGBV.exe 2988 Host.exe 968 Host.exe 2944 VQAVQ.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 1236 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 30 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2712 wrote to memory of 2300 2712 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 31 PID 2300 wrote to memory of 2988 2300 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 32 PID 2300 wrote to memory of 2988 2300 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 32 PID 2300 wrote to memory of 2988 2300 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 32 PID 2300 wrote to memory of 2988 2300 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 32 PID 1236 wrote to memory of 2136 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 33 PID 1236 wrote to memory of 2136 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 33 PID 1236 wrote to memory of 2136 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 33 PID 1236 wrote to memory of 2136 1236 JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe 33 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 2136 wrote to memory of 900 2136 BVGBV.exe 34 PID 900 wrote to memory of 2832 900 BVGBV.exe 35 PID 900 wrote to memory of 2832 900 BVGBV.exe 35 PID 900 wrote to memory of 2832 900 BVGBV.exe 35 PID 900 wrote to memory of 2832 900 BVGBV.exe 35 PID 900 wrote to memory of 2832 900 BVGBV.exe 35 PID 900 wrote to memory of 2832 900 BVGBV.exe 35 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 968 2988 Host.exe 36 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 2988 wrote to memory of 2472 2988 Host.exe 37 PID 968 wrote to memory of 2944 968 Host.exe 38 PID 968 wrote to memory of 2944 968 Host.exe 38 PID 968 wrote to memory of 2944 968 Host.exe 38 PID 968 wrote to memory of 2944 968 Host.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\BVGBV.exe"C:\Users\Admin\AppData\Local\Temp\BVGBV.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\BVGBV.exe"C:\Users\Admin\AppData\Local\Temp\BVGBV.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\BVGBV.exe"C:\Users\Admin\AppData\Local\Temp\BVGBV.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Roaming\Host.exe"C:\Users\Admin\AppData\Roaming\Host.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b3ff7f2f522779c5bd0cc9862190210.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Roaming\Host.exe"C:\Users\Admin\AppData\Roaming\Host.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\VQAVQ.exe"C:\Users\Admin\AppData\Local\Temp\VQAVQ.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\VQAVQ.exe"C:\Users\Admin\AppData\Local\Temp\VQAVQ.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\VQAVQ.exe"C:\Users\Admin\AppData\Local\Temp\VQAVQ.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Host.exe"C:\Users\Admin\AppData\Roaming\Host.exe"4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2472
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD5c10dbeca73f8835240e08e4511284b83
SHA10032f8f941cc07768189ca6ba32b1beede6b6917
SHA2560b6b62094048f0a069b4582f837afcb941db51340d0b16d578e8cbe8603a071e
SHA51234f7ab8b4ab7b4996b82ffc49198103ef245ee7dd5ccfec793a9ee391b9e9bb30bd3916b4ebeaa9c66a4b5ca42f8572418f16dc83d41073bc94389c19916b967
-
Filesize
320KB
MD5ccc2260269cb43ddadda9444e3d112f7
SHA1ddab46acc12d7c60a15fa363f88030f1dd539fcb
SHA2568ca1bd039407381c33fb7ab570b6e95b0ce64b0d5ef64a1968f9b55647cc1911
SHA512787d0b4f5d89b840a4917c78e46f963c8c96a96ec005b45d085222ef307c2a76f074c4a65ca033b038e1b7d1419c7cd3c5c5f3075c3ea24e546c68bdd7643fde
-
Filesize
368KB
MD57b3ff7f2f522779c5bd0cc9862190210
SHA1efbbee045ba78058f6735a472343fe9748834be8
SHA256dc5225380dea039e3ce7b5156361fc68bc205cfdba8c9976f77192f4979f14d9
SHA512ca3acc3d41a819fb37fd7a37c27fb19250846f5174c4d132e8d4e9f30caaa84aa3405d8c65cafba08328b1c11c445d28136de5bca934aee10156304b43ecf9b6