Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/03/2025, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe
-
Size
632KB
-
MD5
7e290b3489400c6e501962cdbbdcdea9
-
SHA1
d338e6f06d482d6486a113d4115c90b531c088dd
-
SHA256
aec7476b3cc5d23fc8f8652a6255bf652cc03fd985b6de9faa1875103e12bd4d
-
SHA512
70fe2292609d6db16b99a28593e1a2c98af3847fb7d57ef64b6ac4b26572361b7b870a1f3f5316e768b740cd5dbff230e5eda91cb2d0beb87ba13afa69afff4e
-
SSDEEP
12288:7yt+isUdgcRFOvNs534CqdqZfHSVl3fe:7TVUdgcRYaOSyVNf
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 3 IoCs
resource yara_rule behavioral1/memory/2380-15-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer behavioral1/memory/2380-12-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer behavioral1/memory/2380-35-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer -
Isrstealer family
-
Executes dropped EXE 2 IoCs
pid Process 2380 Service.exe 2216 Service.exe -
Loads dropped DLL 2 IoCs
pid Process 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 2380 Service.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 976 set thread context of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 2380 set thread context of 2216 2380 Service.exe 32 -
resource yara_rule behavioral1/memory/2216-23-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-29-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-28-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-27-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-26-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral1/memory/2216-34-0x0000000000400000-0x0000000000453000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Service.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2380 Service.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 976 wrote to memory of 2380 976 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 31 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32 PID 2380 wrote to memory of 2216 2380 Service.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98