Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
29/01/2025, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe
-
Size
933KB
-
MD5
5119b8df58fae088f338fb83d9a2b3bc
-
SHA1
5d6ffd11b68784c6342dc03a044fea4f2550ee1f
-
SHA256
936daa7b23217158833c1e1b9b05a1ebfb07caa12ad53d11481f2c510f30d6fb
-
SHA512
83a0df00d54c89d5f624a211a8f84d421e57d452dd8aa9439822ca218835f8980d149eb392d2adae4064f8a0cafeb2e9c9c46b32c9130b00ee93e0eb1a592e88
-
SSDEEP
12288:ApegXVGSgu10Vdx2mT0tL5kDrPrIrpJl3FbONGNT19Himy8H4CNjGzwUOOUjjoKc:AZsSaQ4PAZ2CJxHjjohNb4i
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/2556-24-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/2556-21-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/2556-42-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer behavioral1/memory/2556-46-0x0000000000400000-0x0000000000435000-memory.dmp family_isrstealer -
Isrstealer family
-
Executes dropped EXE 3 IoCs
pid Process 3008 AutoUpdatePlus.exe 2556 svchost.exe 2104 svchost.exe -
Loads dropped DLL 6 IoCs
pid Process 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 3008 AutoUpdatePlus.exe 3008 AutoUpdatePlus.exe 3008 AutoUpdatePlus.exe 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 2556 svchost.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe" JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1048 set thread context of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 2556 set thread context of 2104 2556 svchost.exe 32 -
resource yara_rule behavioral1/memory/2104-37-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2104-36-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2104-35-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2104-32-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2104-40-0x0000000000400000-0x0000000000453000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoUpdatePlus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3008 AutoUpdatePlus.exe 3008 AutoUpdatePlus.exe 3008 AutoUpdatePlus.exe 3008 AutoUpdatePlus.exe 2556 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 3008 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 30 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 1048 wrote to memory of 2556 1048 JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe 31 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32 PID 2556 wrote to memory of 2104 2556 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5119b8df58fae088f338fb83d9a2b3bc.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\AutoUpdatePlus.exe"C:\Users\Admin\AppData\Local\Temp\AutoUpdatePlus.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe/scomma "C:\Users\Admin\AppData\Local\Temp\k4VPihGPAJ.ini"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3
-
Filesize
440KB
MD5e8b79675961ba6f00a41b947104d2e2a
SHA1c42402bd9aa85624204083970776519eb881d5c3
SHA256515d7111bcdb1ba733a5eb5e486df1b375a018c26df70613d3a20b2e42e217e0
SHA512010951169fecdd530b54a740e7731d3d4aeeb0431ee27fc8cfed55125f7b26b95472aa7aca8f6f92ef3c74174eef0db38785d52b8442692d7b726ad4e1fabbc5
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98