Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
17/03/2025, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe
-
Size
632KB
-
MD5
7e290b3489400c6e501962cdbbdcdea9
-
SHA1
d338e6f06d482d6486a113d4115c90b531c088dd
-
SHA256
aec7476b3cc5d23fc8f8652a6255bf652cc03fd985b6de9faa1875103e12bd4d
-
SHA512
70fe2292609d6db16b99a28593e1a2c98af3847fb7d57ef64b6ac4b26572361b7b870a1f3f5316e768b740cd5dbff230e5eda91cb2d0beb87ba13afa69afff4e
-
SSDEEP
12288:7yt+isUdgcRFOvNs534CqdqZfHSVl3fe:7TVUdgcRYaOSyVNf
Malware Config
Signatures
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/4544-8-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer behavioral2/memory/4544-12-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer behavioral2/memory/4544-28-0x0000000000400000-0x0000000000432000-memory.dmp family_isrstealer -
Isrstealer family
-
Executes dropped EXE 2 IoCs
pid Process 4544 Service.exe 5440 Service.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1704 set thread context of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 4544 set thread context of 5440 4544 Service.exe 88 -
resource yara_rule behavioral2/memory/5440-15-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5440-18-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5440-19-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5440-20-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/5440-24-0x0000000000400000-0x0000000000453000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4544 Service.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 1704 wrote to memory of 4544 1704 JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe 87 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88 PID 4544 wrote to memory of 5440 4544 Service.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e290b3489400c6e501962cdbbdcdea9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exeC:\Users\Admin\AppData\Local\Temp\\AppLaunch\Service.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\AppLaunch\Service.exe/scomma "C:\Users\Admin\AppData\Local\Temp\tmp.ini"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
Filesize
5B
MD5d1ea279fb5559c020a1b4137dc4de237
SHA1db6f8988af46b56216a6f0daf95ab8c9bdb57400
SHA256fcdcc2c46896915a1c695d6231f0fee336a668531b7a3da46178c80362546dba
SHA512720e9c284f0559015312df7fe977563e5e16f48d3506e51eb4016adf7971924d352f740b030aa3adc81b6f65fd1dba12df06d10fa6c115074e5097e7ee0f08b3