Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2025, 07:07

General

  • Target

    JaffaCakes118_482a4a14aa0ecf3db534b4f6e7991b46.exe

  • Size

    432KB

  • MD5

    482a4a14aa0ecf3db534b4f6e7991b46

  • SHA1

    60da5b5530f8001e317660bc049ab061acc1af08

  • SHA256

    11fdd2652e2b36df980e0ca3bc3416f62ef6096ed87d6f2d94bf78a3a4d0ab5d

  • SHA512

    d6af301949b8f542748c02c7efca4ce34dd7ee7afdf1529ecac07eb402f5310e27061c7b9871fe6de9f229bcc6b0e62ab62f0624ee55eadb450c50236149f283

  • SSDEEP

    6144:KIKQFmru0cdPj+13ndRRjrSBWTvOdzx1Xc1s83nlUJpn00D81L0Xmx/sMPfbVvlV:VLdPjwdT3SCu1MS8VO6/ZfJ97f1yqn

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 1 IoCs
  • Isrstealer family
  • Uses the VBS compiler for execution 1 TTPs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_482a4a14aa0ecf3db534b4f6e7991b46.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_482a4a14aa0ecf3db534b4f6e7991b46.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1044-0-0x00007FF82C225000-0x00007FF82C226000-memory.dmp

    Filesize

    4KB

  • memory/1044-1-0x00007FF82BF70000-0x00007FF82C911000-memory.dmp

    Filesize

    9.6MB

  • memory/1044-2-0x000000001B8C0000-0x000000001BD8E000-memory.dmp

    Filesize

    4.8MB

  • memory/1044-3-0x000000001B2A0000-0x000000001B346000-memory.dmp

    Filesize

    664KB

  • memory/1044-4-0x000000001B350000-0x000000001B3BC000-memory.dmp

    Filesize

    432KB

  • memory/1044-5-0x00007FF82BF70000-0x00007FF82C911000-memory.dmp

    Filesize

    9.6MB

  • memory/1044-6-0x000000001BED0000-0x000000001BF21000-memory.dmp

    Filesize

    324KB

  • memory/1044-8-0x00007FF82BF70000-0x00007FF82C911000-memory.dmp

    Filesize

    9.6MB