Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...98.dll

windows7-x64

10

JaffaCakes...98.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2024, 05:11 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_6ba5374a57f997f0343b7088e3b3a882f0ab8030eff21355fb9a29f282b4a798.dll

  • Size

    337KB

  • MD5

    8d0a602b30c1737b9270d3d9c3483f7f

  • SHA1

    bdbd10daa9722922de013c52ed03a29aa3970428

  • SHA256

    6ba5374a57f997f0343b7088e3b3a882f0ab8030eff21355fb9a29f282b4a798

  • SHA512

    8ae37b7e43dd860fcf7cc90c74ba2fde3df6bb9394f87e7b5242d473b2da77cdfb8ba5cb25e9c66599cb73fb27fab4c9af66c8c1f25686bec1d5dfd7f9e5dd5b

  • SSDEEP

    6144:W2qOZMfQw8fRGgJj65m7TJhjcll5WaZplFY00vgFqIDohuupc:7mowiRGg56YTXMl5P2v4o

Score
10/10
icedid988048349bankerloadertrojan

Malware Config

Extracted

Family

icedid

Campaign

988048349

C2

keepfootbal.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

    trojanbankericedid
  • Icedid family
    icedid
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6ba5374a57f997f0343b7088e3b3a882f0ab8030eff21355fb9a29f282b4a798.dll
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2084

Network

  • flag-us
    DNS
    aws.amazon.com
    regsvr32.exe
    Remote address:
    8.8.8.8:53
    Request
    aws.amazon.com
    IN A
    Response
    aws.amazon.com
    IN CNAME
    tp.8e49140c2-frontier.amazon.com
    tp.8e49140c2-frontier.amazon.com
    IN CNAME
    dr49lng3n1n2s.cloudfront.net
    dr49lng3n1n2s.cloudfront.net
    IN A
    3.162.38.112
    dr49lng3n1n2s.cloudfront.net
    IN A
    3.162.38.14
    dr49lng3n1n2s.cloudfront.net
    IN A
    3.162.38.126
    dr49lng3n1n2s.cloudfront.net
    IN A
    3.162.38.78
  • flag-us
    DNS
    keepfootbal.com
    regsvr32.exe
    Remote address:
    8.8.8.8:53
    Request
    keepfootbal.com
    IN A
    Response
  • 3.162.38.112:443
    aws.amazon.com
    tls
    regsvr32.exe
    348 B
     219 B
     5
    5
  • 3.162.38.112:443
    aws.amazon.com
    tls
    regsvr32.exe
    288 B
     219 B
     5
    5
  • 8.8.8.8:53
    aws.amazon.com
    dns
    regsvr32.exe
    60 B
     202 B
     1
    1

    DNS Request

    aws.amazon.com

    DNS Response

    3.162.38.112
    3.162.38.14
    3.162.38.126
    3.162.38.78

  • 8.8.8.8:53
    keepfootbal.com
    dns
    regsvr32.exe
    61 B
     134 B
     1
    1

    DNS Request

    keepfootbal.com

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2084-0-0x00000000004F0000-0x00000000004F9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2084-1-0x00000000004F0000-0x00000000004F9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2084-2-0x00000000004F0000-0x00000000004F9000-memory.dmp

    Filesize

    36KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.