Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 20:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_96bbed3cef8ed674e9bf12fcefd8eca119d682b405ea9a3c833b89cfb9c7554c.dll
Resource
win7-20241023-en
4 signatures
150 seconds
General
-
Target
JaffaCakes118_96bbed3cef8ed674e9bf12fcefd8eca119d682b405ea9a3c833b89cfb9c7554c.dll
-
Size
80KB
-
MD5
9e29f923b58fdf528bd1cf9c39198059
-
SHA1
deadf64a82630e87f21e4859ae70ed43a8380122
-
SHA256
96bbed3cef8ed674e9bf12fcefd8eca119d682b405ea9a3c833b89cfb9c7554c
-
SHA512
0d6158e1747f06da205c4cb05495d1c8cf76c0120f74a56cfc5ef9438ba80403c7e5308420fb11e438a2386ee7d8c3a14d5a86ee6bc8dd87301b5e5d2d0e25e3
-
SSDEEP
768:pWadwr+b2aikC6DwLUslDgXBpH/zuVQX9pzvjU4YqsABzktk42mWhlzS8q:75ikC6DwLUHfzDX9JU4YK83Az9
Malware Config
Extracted
Family
icedid
Campaign
358151332
C2
azorropulseee.fun
Signatures
-
Icedid family
-
IcedID First Stage Loader 1 IoCs
resource yara_rule behavioral2/memory/3596-1-0x0000000001310000-0x0000000001317000-memory.dmp IcedidFirstLoader -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3596 regsvr32.exe 3596 regsvr32.exe