Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 21:19 UTC
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40b47b67cc7aedcbc59c7aa61921707a72b050e48385239d09f6d8b6d9b1ac7f.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40b47b67cc7aedcbc59c7aa61921707a72b050e48385239d09f6d8b6d9b1ac7f.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40b47b67cc7aedcbc59c7aa61921707a72b050e48385239d09f6d8b6d9b1ac7f.dll
-
Size
490KB
-
MD5
47bef6773cc44e43461f986cb3ed877e
-
SHA1
8a32cc537dedd23a28c89ffed5b50723b22d679c
-
SHA256
40b47b67cc7aedcbc59c7aa61921707a72b050e48385239d09f6d8b6d9b1ac7f
-
SHA512
dde36674a8ee86d3c1b91ea4c096cba10120194e7d7fdbe57bdc9ac0a9b37962f183c576f25f11050263e0032e76bb51ec5ba22d834c1e24e92a9dd58ff30715
-
SSDEEP
12288:mFnmEQb6xK6EOcEELeBdUDBBe6pLtzPhGHUaRC:knmj6xK1y3Ik6TZGRC
Malware Config
Extracted
icedid
3467965077
firenicatrible.com
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request121.118.77.104.in-addr.arpaIN PTRResponse121.118.77.104.in-addr.arpaIN PTRa104-77-118-121deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfirenicatrible.comIN AResponse
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
121.118.77.104.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
-
64 B 137 B 1 1
DNS Request
firenicatrible.com