Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    28s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2025, 21:33 UTC

General

  • Target

    JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe

  • Size

    602KB

  • MD5

    77fe484c6fe1662924343098eebca2c2

  • SHA1

    2297f067be6dee591fc2c8806a7230220328b79a

  • SHA256

    4abc945b21b66014655876d38f943cedf264760378baca3cb8c5953578401438

  • SHA512

    c845379f8a17a3626133114d3829b563bc53a06ed91c7a4dc489ff0a339df832e0717d25550f1fa026af2c1e6dcfcc033540ff2d5f39612109450fc3b2427fb5

  • SSDEEP

    12288:c8qBf7bX+2+brqKG7ni9bgkWVkR69uGn0Adhd4bsUHXIRG:c8qNPX+2c4iho3umDDUY

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 4 IoCs
  • Isrstealer family
  • Detected Nirsoft tools 8 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77fe484c6fe1662924343098eebca2c2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\SysWOW64\wininit.exe
      "C:\Windows\system32\wininit.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\wininit.exe
        "C:\Windows\SysWOW64\wininit.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Windows\SysWOW64\wininit.exe
          "C:\Windows\SysWOW64\wininit.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2728
        • C:\Windows\SysWOW64\wininit.exe
          "C:\Windows\SysWOW64\wininit.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data1.dmp
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1308
        • C:\Windows\SysWOW64\wininit.exe
          "C:\Windows\SysWOW64\wininit.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data2.dmp
          4⤵
          • Accesses Microsoft Outlook accounts
          • System Location Discovery: System Language Discovery
          PID:328

Network

  • flag-us
    DNS
    rootme.no-ip.org
    wininit.exe
    Remote address:
    8.8.8.8:53
    Request
    rootme.no-ip.org
    IN A
    Response
No results found
  • 8.8.8.8:53
    rootme.no-ip.org
    dns
    wininit.exe
    62 B
    122 B
    1
    1

    DNS Request

    rootme.no-ip.org

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/328-60-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/328-55-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/328-58-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/328-59-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/1308-51-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1308-53-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1308-52-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1308-54-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1308-46-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1308-62-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2304-0-0x0000000074441000-0x0000000074442000-memory.dmp

    Filesize

    4KB

  • memory/2304-1-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2304-2-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2304-3-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2304-36-0x0000000074440000-0x00000000749EB000-memory.dmp

    Filesize

    5.7MB

  • memory/2484-12-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2484-6-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2484-63-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2484-4-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2484-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2484-8-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2484-14-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/2728-65-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2728-38-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2728-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2728-42-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2728-45-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2728-44-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2804-34-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-19-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-23-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-35-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-37-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-33-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-27-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-25-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-17-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-21-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-61-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2804-29-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.