Analysis
-
max time kernel
1828s -
max time network
1737s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
16-02-2022 17:24
General
-
Target
all/gcs/Icetea.exe
-
Size
629KB
-
MD5
ec75749551b255093e77a5d6c1d72e1b
-
SHA1
fac81f6c1f1bd668b66f2d1d84c6fe2a4e6b0c98
-
SHA256
1a9f99be6ea38d09047da97d68350d5c04f59cd40269569271ff3231fbabb32d
-
SHA512
2db7db3fe569d70e476d05f8b4e88e2f5d22ecccce12dca745208001078d0cd9c7f00711b32c2599d2b594f98a6a6ff20ef9c133d3c133654782788f8e5198e8
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\all\gcs\Icetea.exe"C:\Users\Admin\AppData\Local\Temp\all\gcs\Icetea.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB