Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 05:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll
Resource
win7-20240508-en
4 signatures
150 seconds
General
-
Target
5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll
-
Size
406KB
-
MD5
5d7ce2398942eb03bd0065aea3d5da15
-
SHA1
8c1977305284f6ef719d6e92f0e90f069476a62a
-
SHA256
705e14735da74b107357a676c15b07c0f0c86888b8f98ba86e1029ff4e4858df
-
SHA512
a014ab056f924d3a037df8bbdd59cc8e3f95a25c5c6fed04a5a90aa848aca5af2700b4ae1367d9a92efe7eb82265c8c5ecf5e24ba251bc752c68ba49bece9fa6
-
SSDEEP
6144:MU/OLpMfiR6vtVIgyPFiChgkX7WOMeLpebnZgUe4A29pNwzg:MU/OLCf1LqPACIeoFa4A29Dwzg
Malware Config
Extracted
Family
icedid
C2
ldrruble.casa
Signatures
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral2/memory/3388-1-0x0000000075360000-0x000000007541F000-memory.dmp IcedidFirstLoader -
Blocklisted process makes network request 14 IoCs
flow pid Process 32 3388 rundll32.exe 35 3388 rundll32.exe 37 3388 rundll32.exe 38 3388 rundll32.exe 53 3388 rundll32.exe 57 3388 rundll32.exe 60 3388 rundll32.exe 62 3388 rundll32.exe 66 3388 rundll32.exe 73 3388 rundll32.exe 91 3388 rundll32.exe 93 3388 rundll32.exe 94 3388 rundll32.exe 97 3388 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4412 wrote to memory of 3388 4412 rundll32.exe 83 PID 4412 wrote to memory of 3388 4412 rundll32.exe 83 PID 4412 wrote to memory of 3388 4412 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5d7ce2398942eb03bd0065aea3d5da15_JaffaCakes118.dll,#12⤵
- Blocklisted process makes network request
PID:3388
-