91cd8bfbe714acc43beff32856c3d56ded48706d3c92c492a1acb994b606003b

Analysis

max time kernel
1828s
max time network
1737s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16-02-2022 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

all/gcs/Icetea.exe
Size

629KB
MD5

ec75749551b255093e77a5d6c1d72e1b
SHA1

fac81f6c1f1bd668b66f2d1d84c6fe2a4e6b0c98
SHA256

1a9f99be6ea38d09047da97d68350d5c04f59cd40269569271ff3231fbabb32d
SHA512

2db7db3fe569d70e476d05f8b4e88e2f5d22ecccce12dca745208001078d0cd9c7f00711b32c2599d2b594f98a6a6ff20ef9c133d3c133654782788f8e5198e8

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Icetea.exe

pid process

4944 Icetea.exe

pid	process
4944	Icetea.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Icetea.exesvchost.exeTiWorker.exe

description	pid	process
Token: SeDebugPrivilege	4944	Icetea.exe
Token: SeSecurityPrivilege	4944	Icetea.exe
Token: SeDebugPrivilege	4944	Icetea.exe
Token: SeSecurityPrivilege	4944	Icetea.exe
Token: SeShutdownPrivilege	4696	svchost.exe
Token: SeCreatePagefilePrivilege	4696	svchost.exe
Token: SeShutdownPrivilege	4696	svchost.exe
Token: SeCreatePagefilePrivilege	4696	svchost.exe
Token: SeShutdownPrivilege	4696	svchost.exe
Token: SeCreatePagefilePrivilege	4696	svchost.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe
Token: SeBackupPrivilege	4596	TiWorker.exe
Token: SeRestorePrivilege	4596	TiWorker.exe
Token: SeSecurityPrivilege	4596	TiWorker.exe

C:\Users\Admin\AppData\Local\Temp\all\gcs\Icetea.exe
"C:\Users\Admin\AppData\Local\Temp\all\gcs\Icetea.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4696-130-0x0000017FB0580000-0x0000017FB0590000-memory.dmp

Filesize
64KB

Download
memory/4696-131-0x0000017FB0C20000-0x0000017FB0C30000-memory.dmp

Filesize
64KB

Download
memory/4696-132-0x0000017FB3300000-0x0000017FB3304000-memory.dmp

Filesize
16KB

Download
memory/4696-133-0x0000017FB3320000-0x0000017FB3324000-memory.dmp

Filesize
16KB

Download
memory/4696-134-0x0000017FB3260000-0x0000017FB3261000-memory.dmp

Filesize
4KB

Download
memory/4696-136-0x0000017FB3220000-0x0000017FB3221000-memory.dmp

Filesize
4KB

Download