Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2025, 10:20

General

  • Target

    JaffaCakes118_79dd0667f51035f1b8322d10acf1688b.exe

  • Size

    489KB

  • MD5

    79dd0667f51035f1b8322d10acf1688b

  • SHA1

    fe21c49313ad7dacdca94211eb635540551b4f28

  • SHA256

    fb30f6f2adef10ea9f6806afb731977b7d6c67dfddd891eab99a0a8ad3048751

  • SHA512

    921eefd772ef2d1d3553db57174cf66cbcc6bbe9f745cd68fea6e0a9683ffd860e0460a3e6037dbe4848051161631d35dea1a6ea88ce0fb195fa5e26d140a23e

  • SSDEEP

    12288:OVW0BLp7vXRxcBAlhQaVYZiEk2NZjEpPceXQK:OVJLp7vXRqBAlhQxYLIqqK

Malware Config

Signatures

  • ISR Stealer

    ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

  • ISR Stealer payload 5 IoCs
  • Isrstealer family
  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79dd0667f51035f1b8322d10acf1688b.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79dd0667f51035f1b8322d10acf1688b.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Users\Admin\AppData\Local\Temp\tmp41EB.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp41EB.tmp.exe" -p
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3284
    • C:\Users\Admin\AppData\Local\Temp\tmp41EB.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp41EB.tmp.exe" -p
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:6132
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\\vbc.exe
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        /scomma "C:\Users\Admin\AppData\Local\Temp\FgPZkDwjBM.ini"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4976
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        /scomma "C:\Users\Admin\AppData\Local\Temp\aU3ZZMLEDn.ini"
        3⤵
        • Accesses Microsoft Outlook accounts
        • System Location Discovery: System Language Discovery
        PID:3108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tmp41EB.tmp.exe.log

    Filesize

    217B

    MD5

    594f9a7c2c9174efbb2099b6b21ca0c1

    SHA1

    859abbb672399e195267d2ebd57395ae9153dcd0

    SHA256

    3f56509adf13b45203567538dcd316e5217122182ff5b051da5ea2edc6bbc9a7

    SHA512

    13680a4fb1d115efb80d1fc2888420c48af6429360b6d14d77a60ed57d15c29233f424955e4b840a131d40881507b1465beeac1aa258b6ca20d311a668240b7d

  • C:\Users\Admin\AppData\Local\Temp\FgPZkDwjBM.ini

    Filesize

    5B

    MD5

    d1ea279fb5559c020a1b4137dc4de237

    SHA1

    db6f8988af46b56216a6f0daf95ab8c9bdb57400

    SHA256

    fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba

    SHA512

    720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3

  • C:\Users\Admin\AppData\Local\Temp\tmp41EB.tmp.exe

    Filesize

    489KB

    MD5

    79dd0667f51035f1b8322d10acf1688b

    SHA1

    fe21c49313ad7dacdca94211eb635540551b4f28

    SHA256

    fb30f6f2adef10ea9f6806afb731977b7d6c67dfddd891eab99a0a8ad3048751

    SHA512

    921eefd772ef2d1d3553db57174cf66cbcc6bbe9f745cd68fea6e0a9683ffd860e0460a3e6037dbe4848051161631d35dea1a6ea88ce0fb195fa5e26d140a23e

  • memory/1544-51-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1544-22-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1544-25-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1544-57-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1544-59-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/3108-54-0x0000000000470000-0x0000000000539000-memory.dmp

    Filesize

    804KB

  • memory/3108-56-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3108-52-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3108-53-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3108-50-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/3284-20-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3284-16-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3284-17-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/3284-19-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4168-29-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4168-1-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4168-2-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/4168-0-0x0000000074D02000-0x0000000074D03000-memory.dmp

    Filesize

    4KB

  • memory/4976-35-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4976-34-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4976-39-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4976-33-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/4976-32-0x0000000000400000-0x0000000000453000-memory.dmp

    Filesize

    332KB

  • memory/6132-27-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/6132-40-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

  • memory/6132-26-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB