Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_2977a60c2152fd24dc5aac6e88de8049
-
Size
1.6MB
-
Sample
250125-jfjwcatqfn
-
MD5
2977a60c2152fd24dc5aac6e88de8049
-
SHA1
8715bb5732eed4ec20eed1dd31d731197763e4fb
-
SHA256
460ab58bc9a6f47d54403e74511e24f2e499081fb3af6ba9b92ddc337cc8feaa
-
SHA512
fc47fe700c0e4ae8d72be6f2925889c74e504ae60915007c3753311f08067f88bc08e15591cfd535948a52c25d208cd605c20d29b9ec16dde7d45242da5611b3
-
SSDEEP
24576:2sR3lMiam9l7rdJczfYx3wH7JnrqKsscuq7N9CgexI9SQ//ZKpvcvoXXK8FzAMif:2sh1fazfi3Khrc37zV0nK8FzAp+nW
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2977a60c2152fd24dc5aac6e88de8049.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2977a60c2152fd24dc5aac6e88de8049.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
JaffaCakes118_2977a60c2152fd24dc5aac6e88de8049
-
Size
1.6MB
-
MD5
2977a60c2152fd24dc5aac6e88de8049
-
SHA1
8715bb5732eed4ec20eed1dd31d731197763e4fb
-
SHA256
460ab58bc9a6f47d54403e74511e24f2e499081fb3af6ba9b92ddc337cc8feaa
-
SHA512
fc47fe700c0e4ae8d72be6f2925889c74e504ae60915007c3753311f08067f88bc08e15591cfd535948a52c25d208cd605c20d29b9ec16dde7d45242da5611b3
-
SSDEEP
24576:2sR3lMiam9l7rdJczfYx3wH7JnrqKsscuq7N9CgexI9SQ//ZKpvcvoXXK8FzAMif:2sh1fazfi3Khrc37zV0nK8FzAp+nW
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Isrstealer family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-