Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2025, 10:42 UTC
Static task
static1
1 signatures
General
-
Target
JaffaCakes118_e232cad0e45cc281091fc7f35a8a3285.exe
-
Size
432KB
-
MD5
e232cad0e45cc281091fc7f35a8a3285
-
SHA1
31b0d6d8cc7a8666bd80d19b2291fb5ce0048e0c
-
SHA256
59370070d76a1c270e5f838d4f2c293f5bf5625fb1191fba8fd6b1096db01bfb
-
SHA512
fa62187139cda6a4b07bad7052ff29b7c9b044d6acf1b7e138200d63077ae84c91a3ccf68572ce92a238cd09ee0ad5ff1165c619f138562afd329b420efc10ee
-
SSDEEP
12288:ZUCmZiC9rRlxFsvCxWL81IDzmqplwt6dEs2CD+z:jCHlndYzFWtIV6
Malware Config
Signatures
-
Expiro family
-
Expiro payload 3 IoCs
resource yara_rule behavioral1/memory/1428-0-0x0000000000470000-0x0000000000504000-memory.dmp family_expiro1 behavioral1/memory/1428-1-0x0000000000470000-0x0000000000504000-memory.dmp family_expiro1 behavioral1/memory/1428-2-0x0000000000400000-0x0000000000504000-memory.dmp family_expiro1
Processes
Network
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request60.153.16.2.in-addr.arpaIN PTRResponse60.153.16.2.in-addr.arpaIN PTRa2-16-153-60deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request2.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
No results found
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
60.153.16.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
31.243.111.52.in-addr.arpa