Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
28s -
max time network
29s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
15/03/2025, 21:33 UTC
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe
-
Size
602KB
-
MD5
77fe484c6fe1662924343098eebca2c2
-
SHA1
2297f067be6dee591fc2c8806a7230220328b79a
-
SHA256
4abc945b21b66014655876d38f943cedf264760378baca3cb8c5953578401438
-
SHA512
c845379f8a17a3626133114d3829b563bc53a06ed91c7a4dc489ff0a339df832e0717d25550f1fa026af2c1e6dcfcc033540ff2d5f39612109450fc3b2427fb5
-
SSDEEP
12288:c8qBf7bX+2+brqKG7ni9bgkWVkR69uGn0Adhd4bsUHXIRG:c8qNPX+2c4iho3umDDUY
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/2484-12-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2484-8-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2484-14-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2484-63-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer -
Isrstealer family
-
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2728-42-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/1308-53-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/1308-62-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2728-45-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/2728-44-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/328-60-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/1308-54-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2728-65-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/328-60-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2728-42-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2728-45-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2728-44-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2728-65-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wininit.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2304 set thread context of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2484 set thread context of 2804 2484 wininit.exe 30 PID 2804 set thread context of 2728 2804 wininit.exe 31 PID 2804 set thread context of 1308 2804 wininit.exe 32 PID 2804 set thread context of 328 2804 wininit.exe 33 -
resource yara_rule behavioral1/memory/1308-53-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1308-62-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/328-60-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/328-59-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/328-58-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/1308-54-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1308-52-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1308-51-0x0000000000400000-0x0000000000426000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wininit.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2484 wininit.exe 2484 wininit.exe 2484 wininit.exe 2484 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe Token: SeDebugPrivilege 1308 wininit.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2484 wininit.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2304 wrote to memory of 2484 2304 JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe 29 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2484 wrote to memory of 2804 2484 wininit.exe 30 PID 2804 wrote to memory of 2728 2804 wininit.exe 31 PID 2804 wrote to memory of 2728 2804 wininit.exe 31 PID 2804 wrote to memory of 2728 2804 wininit.exe 31 PID 2804 wrote to memory of 2728 2804 wininit.exe 31 PID 2804 wrote to memory of 2728 2804 wininit.exe 31 PID 2804 wrote to memory of 2728 2804 wininit.exe 31 PID 2804 wrote to memory of 1308 2804 wininit.exe 32 PID 2804 wrote to memory of 1308 2804 wininit.exe 32 PID 2804 wrote to memory of 1308 2804 wininit.exe 32 PID 2804 wrote to memory of 1308 2804 wininit.exe 32 PID 2804 wrote to memory of 1308 2804 wininit.exe 32 PID 2804 wrote to memory of 1308 2804 wininit.exe 32 PID 2804 wrote to memory of 328 2804 wininit.exe 33 PID 2804 wrote to memory of 328 2804 wininit.exe 33 PID 2804 wrote to memory of 328 2804 wininit.exe 33 PID 2804 wrote to memory of 328 2804 wininit.exe 33 PID 2804 wrote to memory of 328 2804 wininit.exe 33 PID 2804 wrote to memory of 328 2804 wininit.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\system32\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp4⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data1.dmp4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data2.dmp4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:328
-
-
-