Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2022, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
Invoice-trappings_adv-82894_ISO/Document.lnk
Resource
win10v2004-20220901-en
Behavioral task
behavioral2
Sample
Invoice-trappings_adv-82894_ISO/cabjawbitsly/fellowshipping.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Invoice-trappings_adv-82894_ISO/cabjawbitsly/wastingworship.bat
Resource
win10v2004-20220812-en
General
-
Target
Invoice-trappings_adv-82894_ISO/cabjawbitsly/fellowshipping.dll
-
Size
127KB
-
MD5
b116a4f4f1f11921e4116e72ecc776e9
-
SHA1
0fe7b18f045befc64e43ef6c5f0a684e6471549a
-
SHA256
403e04507ba3e5a2db7b85bae0b4d4c3588bfffa4fbcdd2bf7e29c68a2543dc3
-
SHA512
255a8c4c81404b1ae4e56d63fc872e6426a40e62736ee48f760f0e92fa75221945bb24bd820aaaf0c7bd51bbb816b3c523126ebe17965c214d1e7a54549f4bc2
-
SSDEEP
1536:fXBU4lRA49aRkLM0CU/WuYBlukta0pooMo67L4j9H1AXcbcAfZ4BWIJ+lcNMy:PBU4lp9KkL7CiJkEro670j9H1hcwy
Malware Config
Extracted
icedid
4182817597
salimjizita.com
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 6 3480 rundll32.exe 39 3480 rundll32.exe 40 3480 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3480 rundll32.exe 3480 rundll32.exe