Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 16:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
General
-
Target
55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll
-
Size
211KB
-
MD5
55a8da7ffdb5beeb293e27851793bb52
-
SHA1
35fa0d2ce0d459524b79e3b3b839b50639a8052e
-
SHA256
c91847b9b00dddebd4f694412f2cc4c7346c15aa3cda2da856d9b0860a17ec50
-
SHA512
28ddd40b08bf83e89b0c92d89159e79f0103d7add097ab099a26103eb31f52a4ec9669290ccfa588d7075e71d712b34c10b625d644a425107535208307dbdb53
-
SSDEEP
6144:6ZLwRyyWMa3NIBkL6LDW8dTZdw702edvxiuYOO6umz4N:6ZLwRyyHadIBkLIi8dTL2SvguYOO1mkN
Malware Config
Extracted
Family
icedid
C2
ldrstar.casa
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral1/memory/2484-1-0x0000000074ED0000-0x0000000074F5C000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 36 IoCs
flow pid Process 3 2484 rundll32.exe 4 2484 rundll32.exe 6 2484 rundll32.exe 7 2484 rundll32.exe 9 2484 rundll32.exe 10 2484 rundll32.exe 12 2484 rundll32.exe 13 2484 rundll32.exe 17 2484 rundll32.exe 18 2484 rundll32.exe 19 2484 rundll32.exe 20 2484 rundll32.exe 22 2484 rundll32.exe 23 2484 rundll32.exe 25 2484 rundll32.exe 26 2484 rundll32.exe 28 2484 rundll32.exe 29 2484 rundll32.exe 31 2484 rundll32.exe 32 2484 rundll32.exe 33 2484 rundll32.exe 34 2484 rundll32.exe 36 2484 rundll32.exe 37 2484 rundll32.exe 39 2484 rundll32.exe 40 2484 rundll32.exe 42 2484 rundll32.exe 43 2484 rundll32.exe 45 2484 rundll32.exe 46 2484 rundll32.exe 47 2484 rundll32.exe 48 2484 rundll32.exe 50 2484 rundll32.exe 51 2484 rundll32.exe 53 2484 rundll32.exe 54 2484 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1516 wrote to memory of 2484 1516 rundll32.exe 28 PID 1516 wrote to memory of 2484 1516 rundll32.exe 28 PID 1516 wrote to memory of 2484 1516 rundll32.exe 28 PID 1516 wrote to memory of 2484 1516 rundll32.exe 28 PID 1516 wrote to memory of 2484 1516 rundll32.exe 28 PID 1516 wrote to memory of 2484 1516 rundll32.exe 28 PID 1516 wrote to memory of 2484 1516 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\55a8da7ffdb5beeb293e27851793bb52_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:2484
-