Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
afb81317dd6442e5f305393674182025.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
afb81317dd6442e5f305393674182025.dll
Resource
win10v2004-20241007-en
General
-
Target
afb81317dd6442e5f305393674182025.dll
-
Size
154KB
-
MD5
afb81317dd6442e5f305393674182025
-
SHA1
24cc7603424e154d8a6b38f37464c4a584220ced
-
SHA256
1f2358aa55626a734911da01bddc40059eb398eb468744d0ba9174468f57cb07
-
SHA512
fb3bd59bf53e30ad9c479ddffe5cad4ee77a5725af19f012a29a14ae3911818a27cfd7038fb3be2e7524fe4111bb9ba5c67144e5f76268c8bc263171b334a647
-
SSDEEP
1536:Dvf1BPhZCGp+AK4zLl9E1Y3wvaowg6Sla6JwLfyUTuUgylQ3JBx6Ro:DvfnuGp+AK4zLl9E1Y3wvam7Ug1BV
Malware Config
Extracted
icedid
2292720537
klicjop9.fun
Signatures
-
Icedid family
-
IcedID First Stage Loader 2 IoCs
resource yara_rule behavioral1/memory/2592-0-0x0000000000180000-0x0000000000187000-memory.dmp IcedidFirstLoader behavioral1/memory/2592-1-0x0000000000180000-0x0000000000187000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2592 regsvr32.exe 2592 regsvr32.exe