Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/03/2025, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe
-
Size
481KB
-
MD5
785e50fbd71019805a7979d83a98972a
-
SHA1
1527ca576e292205bc084e99c439b4b42607dc1e
-
SHA256
9ffdc9c7ec35f2e747c109071c0ec23995a7261674d3f6915fec1e3af904a12f
-
SHA512
90715fd7bcfdaaefd84d5470c18a7cc169eee550dbba0c5fe065267313ae7c06c2a68053b16522022b95420099a3345076522ae9137991fee94fdfa403e0d286
-
SSDEEP
12288:68aXcGD59oXrDvD4d6NUJcoNLeTPmo4ydpb:iXcI59Gr7D44eYTpb
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/2216-5-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2216-8-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2216-66-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2216-76-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer -
Isrstealer family
-
Detected Nirsoft tools 10 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2876-37-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/2876-39-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/2184-65-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2876-40-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/2184-62-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2184-61-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2828-59-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2828-56-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2876-70-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/2828-73-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/2828-59-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/2828-56-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/2828-73-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2876-37-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2876-39-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2876-40-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2876-70-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2304 set thread context of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2216 set thread context of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2996 set thread context of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 set thread context of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 set thread context of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33 -
resource yara_rule behavioral1/memory/2828-51-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2184-46-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2184-65-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2184-62-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2184-61-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2184-60-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2828-59-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2828-56-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2828-55-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2828-73-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2184 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2304 wrote to memory of 2216 2304 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 29 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2216 wrote to memory of 2996 2216 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 30 PID 2996 wrote to memory of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 wrote to memory of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 wrote to memory of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 wrote to memory of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 wrote to memory of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 wrote to memory of 2876 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 31 PID 2996 wrote to memory of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 wrote to memory of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 wrote to memory of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 wrote to memory of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 wrote to memory of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 wrote to memory of 2184 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 32 PID 2996 wrote to memory of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33 PID 2996 wrote to memory of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33 PID 2996 wrote to memory of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33 PID 2996 wrote to memory of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33 PID 2996 wrote to memory of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33 PID 2996 wrote to memory of 2828 2996 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp4⤵
- System Location Discovery: System Language Discovery
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data1.dmp4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data2.dmp4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2828
-
-
-