Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

WhySoSerious 1.1.exe

windows7-x64

10

WhySoSerious 1.1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8615194f50bc96f0825193b1880916d0

  • Size

    440KB

  • Sample

    250322-n837xawmy2

  • MD5

    8615194f50bc96f0825193b1880916d0

  • SHA1

    62d57443f5f659cdf664ab48b5eb425612f6dc9e

  • SHA256

    821861515a96751140747b59f4a4ab0945db40c648bd47172588430a3e4f8de3

  • SHA512

    e16bef7fc2c4ddcfdcbc0859d7fdc84b7a5c5dcd8d96fc54ae03eba88fc0cc83367efd3aeb6b1f89dc49cb2dd6a42478d88860cc25e5c0a84e78a9e0c49dafd6

  • SSDEEP

    12288:3Hcb0e744rBWBbOi8H0jkksJuzh3WJFvTxmabOgkRbFs:3HxMnrBx7HUkkGT3l3bw8

Score
10/10
isrstealerdiscoveryspywarestealertrojanupx

Malware Config

Targets

    • Target

      WhySoSerious 1.1.exe

    • Size

      489KB

    • MD5

      92f9f0c7511954d81dcf3c9a82ae718b

    • SHA1

      6cea37af9d6044b446f322e3c7ea58b15b126a90

    • SHA256

      987e7591865d74ef7398282a7921b83236a75df8bfeb29263fba3e650fd255da

    • SHA512

      580879d223d823a0ccaef9db852759b58504fd9d75afc60e03d71ba541c89f6bcdaade96ec668e7567f335bb6db36912502cc109569b5fcaedff96d149af9b56

    • SSDEEP

      12288:VK2mhAMJ/cPlqmuGfIzdRimjx5fxfbQzrje4PIVY4Nc9B1Mul0bOW03Ok:02O/GlqSIzdPP5zQ/jR8Y4y9TZGw

    Score
    10/10
    isrstealerdiscoveryspywarestealertrojanupx

    • ISR Stealer

      ISR Stealer is a modified version of Hackhound Stealer written in visual basic.

      trojanstealerisrstealer

    • ISR Stealer payload

    • Isrstealer family

      isrstealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks