Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
26/02/2025, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_235138719883429e805b3fd05310326a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_235138719883429e805b3fd05310326a.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_235138719883429e805b3fd05310326a.exe
-
Size
329KB
-
MD5
235138719883429e805b3fd05310326a
-
SHA1
341de6cf3a38d8fe9cf1a1f3896d8741a83bf1ff
-
SHA256
cc94e513464e869cef5da4aa050de54fd8afaa879ea1ba545ac0a9a83e630a8c
-
SHA512
79925b81fab713cffd9e9609f4b7737f1d7b27e9240d8d788483e223b5b20d8b9837c1737708f702b4830b3dc06055aa25d24026b0cdf7197459af9fdd2baaa3
-
SSDEEP
6144:K4eZA+tMPSkR8Zbd+z6oxVr/d6bVdNKfiH/Og++H6oMdMYTyalG4:K4eZA+tMPSxZbd46GlmTOg++HKKYl
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 7 IoCs
resource yara_rule behavioral2/memory/5080-0-0x0000000000400000-0x0000000000449000-memory.dmp family_isrstealer behavioral2/memory/5080-2-0x0000000000400000-0x0000000000449000-memory.dmp family_isrstealer behavioral2/memory/5080-3-0x0000000000400000-0x0000000000449000-memory.dmp family_isrstealer behavioral2/memory/1896-4-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1896-6-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1896-15-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer behavioral2/memory/1896-16-0x0000000000400000-0x0000000000442000-memory.dmp family_isrstealer -
Isrstealer family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/4584-13-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/4584-12-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/4584-14-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4584-13-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/4584-12-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/4584-14-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts JaffaCakes118_235138719883429e805b3fd05310326a.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4032 set thread context of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 5080 set thread context of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 1896 set thread context of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 set thread context of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 -
resource yara_rule behavioral2/memory/4584-9-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4584-11-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4584-13-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4584-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4584-14-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 748 5076 WerFault.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_235138719883429e805b3fd05310326a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_235138719883429e805b3fd05310326a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_235138719883429e805b3fd05310326a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_235138719883429e805b3fd05310326a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 4032 wrote to memory of 5080 4032 JaffaCakes118_235138719883429e805b3fd05310326a.exe 85 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 5080 wrote to memory of 1896 5080 JaffaCakes118_235138719883429e805b3fd05310326a.exe 86 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 5076 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 87 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97 PID 1896 wrote to memory of 4584 1896 JaffaCakes118_235138719883429e805b3fd05310326a.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe/scomma "C:\Users\Admin\AppData\Local\Temp\AEhmpng7Cd.ini"4⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 845⤵
- Program crash
PID:748
-
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_235138719883429e805b3fd05310326a.exe/scomma "C:\Users\Admin\AppData\Local\Temp\ZM5Tl3PYdI.ini"4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:4584
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5076 -ip 50761⤵PID:2520