Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2025, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe
Resource
win10v2004-20250314-en
General
-
Target
JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe
-
Size
481KB
-
MD5
785e50fbd71019805a7979d83a98972a
-
SHA1
1527ca576e292205bc084e99c439b4b42607dc1e
-
SHA256
9ffdc9c7ec35f2e747c109071c0ec23995a7261674d3f6915fec1e3af904a12f
-
SHA512
90715fd7bcfdaaefd84d5470c18a7cc169eee550dbba0c5fe065267313ae7c06c2a68053b16522022b95420099a3345076522ae9137991fee94fdfa403e0d286
-
SSDEEP
12288:68aXcGD59oXrDvD4d6NUJcoNLeTPmo4ydpb:iXcI59Gr7D44eYTpb
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral2/memory/224-0-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral2/memory/224-2-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral2/memory/224-36-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral2/memory/224-37-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer -
Isrstealer family
-
Detected Nirsoft tools 10 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/4988-9-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/1896-17-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral2/memory/1896-16-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral2/memory/4988-13-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/3532-24-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/4988-31-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/3532-30-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/1896-29-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral2/memory/3532-27-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/4988-20-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/3532-24-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/3532-30-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/3532-27-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/4988-9-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral2/memory/4988-13-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral2/memory/4988-31-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral2/memory/4988-20-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 2280 set thread context of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 224 set thread context of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 5072 set thread context of 4988 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 90 PID 5072 set thread context of 1896 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 91 PID 5072 set thread context of 3532 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 92 -
resource yara_rule behavioral2/memory/1896-11-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1896-17-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1896-15-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1896-16-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3532-24-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3532-30-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1896-29-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/3532-27-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3532-23-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3532-21-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1896 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 1896 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1896 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 2280 wrote to memory of 224 2280 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 88 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 224 wrote to memory of 5072 224 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 89 PID 5072 wrote to memory of 4988 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 90 PID 5072 wrote to memory of 4988 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 90 PID 5072 wrote to memory of 4988 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 90 PID 5072 wrote to memory of 4988 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 90 PID 5072 wrote to memory of 4988 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 90 PID 5072 wrote to memory of 1896 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 91 PID 5072 wrote to memory of 1896 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 91 PID 5072 wrote to memory of 1896 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 91 PID 5072 wrote to memory of 1896 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 91 PID 5072 wrote to memory of 1896 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 91 PID 5072 wrote to memory of 3532 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 92 PID 5072 wrote to memory of 3532 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 92 PID 5072 wrote to memory of 3532 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 92 PID 5072 wrote to memory of 3532 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 92 PID 5072 wrote to memory of 3532 5072 JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp4⤵
- System Location Discovery: System Language Discovery
PID:4988
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data1.dmp4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_785e50fbd71019805a7979d83a98972a.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data2.dmp4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:3532
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54B
MD5c10dbeca73f8835240e08e4511284b83
SHA10032f8f941cc07768189ca6ba32b1beede6b6917
SHA2560b6b62094048f0a069b4582f837afcb941db51340d0b16d578e8cbe8603a071e
SHA51234f7ab8b4ab7b4996b82ffc49198103ef245ee7dd5ccfec793a9ee391b9e9bb30bd3916b4ebeaa9c66a4b5ca42f8572418f16dc83d41073bc94389c19916b967