Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 20:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_96bbed3cef8ed674e9bf12fcefd8eca119d682b405ea9a3c833b89cfb9c7554c.dll
Resource
win7-20241023-en
4 signatures
150 seconds
General
-
Target
JaffaCakes118_96bbed3cef8ed674e9bf12fcefd8eca119d682b405ea9a3c833b89cfb9c7554c.dll
-
Size
80KB
-
MD5
9e29f923b58fdf528bd1cf9c39198059
-
SHA1
deadf64a82630e87f21e4859ae70ed43a8380122
-
SHA256
96bbed3cef8ed674e9bf12fcefd8eca119d682b405ea9a3c833b89cfb9c7554c
-
SHA512
0d6158e1747f06da205c4cb05495d1c8cf76c0120f74a56cfc5ef9438ba80403c7e5308420fb11e438a2386ee7d8c3a14d5a86ee6bc8dd87301b5e5d2d0e25e3
-
SSDEEP
768:pWadwr+b2aikC6DwLUslDgXBpH/zuVQX9pzvjU4YqsABzktk42mWhlzS8q:75ikC6DwLUHfzDX9JU4YK83Az9
Malware Config
Extracted
Family
icedid
Campaign
358151332
C2
azorropulseee.fun
Signatures
-
Icedid family
-
IcedID First Stage Loader 2 IoCs
resource yara_rule behavioral1/memory/1048-1-0x00000000005C0000-0x00000000005C7000-memory.dmp IcedidFirstLoader behavioral1/memory/1048-2-0x00000000005C0000-0x00000000005C7000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1048 regsvr32.exe 1048 regsvr32.exe