Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2023 23:08
Behavioral task
behavioral1
Sample
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe
Resource
win7-20230220-en
General
-
Target
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe
-
Size
3.9MB
-
MD5
18b14a8d32a1c4476dad96791bbee0a0
-
SHA1
15d5746127f3f1ca4154d857b22f9e42b82199b6
-
SHA256
169fa42ee9d6a03706c4a202f692e58ac29564cf5028695fabb423885530b653
-
SHA512
e80b1beffd85ab80674e247ee3d1bb11e30968abb3e27bc7f317130577acf844bc757b1b135b6e55770e1e2626b2df265e315640b6277ac457d4dfce27465163
-
SSDEEP
98304:dvfapmo1Y4+6Y7SOEfX/SbgR/ZPYtWJy9iIua3ziX:da9+6Y7SOEibgR/8buaDiX
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4432-133-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon C:\Program Files\7-Zip\Uninstall.exe family_blackmoon -
Detects any file with a triage score of 10 1 IoCs
This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.
Processes:
resource yara_rule C:\Program Files\7-Zip\Uninstall.exe triage_score_10 -
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
XMRig Miner payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/4432-133-0x0000000000400000-0x0000000000613000-memory.dmp xmrig C:\Windows\svchost.exe xmrig C:\Windows\svchost.exe xmrig C:\Program Files\7-Zip\Uninstall.exe xmrig behavioral2/memory/216-353-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-416-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-449-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-523-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-525-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-527-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-529-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-530-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-532-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-533-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-534-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-535-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-537-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/216-538-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 216 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Drops file in System32 directory 64 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process File created C:\Windows\SysWOW64\iscsicpl.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\help.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\SecEdit.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\attrib.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\fltMC.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\wevtutil.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\runas.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\choice.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\mfpmp.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\RpcPing.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\tar.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\TpmInit.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\diskperf.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\msdt.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\mobsync.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\ttdinject.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\Magnify.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\cmd.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\winver.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\schtasks.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\srdelayed.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\bthudtask.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\cipher.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\odbcconf.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\control.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\expand.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\openfiles.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\systeminfo.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\eudcedit.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\prevhost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\regedt32.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\quickassist.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\timeout.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\at.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\dxdiag.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\fontview.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\netsh.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\taskkill.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\w32tm.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\dvdplay.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\fc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\msiexec.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\regini.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\upnpcont.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\certreq.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\diskpart.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\SysWOW64\hh.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ktab.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\pack200.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javacpl.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmic.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\orbd.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Drops file in Windows directory 64 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_ee822d264112a470\powershell_ise.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1_none_d0ebbe21df584658\wmlaunch.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\Narrator.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\diskperf.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.1_none_4aeccdccebca6ca1\ProximityUxHost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\f\licensingdiag.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\f\winload.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\r\schtasks.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\r\DWWIN.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\f\aitstatic.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\wdagtool.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\r\bdeunlock.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.264_none_51891893184281d8\LaunchWinApp.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a22e961d4bcae1e\UndockedDevKit.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\f\AccountsControlHost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.19041.1_none_ceb3891c2721fc43\chkntfs.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1052_none_648fbf276da33ed4\r\NcsiUwpApp.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\ndadmin.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acregl.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\f\VSSVC.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\f\wsl.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_13c446a37d881982\where.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\MsSense.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\r\auditpol.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\f\OOBENetworkCaptivePortal.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\r\SecHealthUI.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\SpatialAudioLicenseSrv.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\dxgiadaptercache.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\winload.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\r\wkspbroker.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\f\autochk.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.84_none_42927ae06bc1dce9\f\WpcMon.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_5aba1063745f6e01\r\autofmt.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\immersivetpmvscmgrsvr.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\SecHealthUI.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\f\mstsc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.19041.1_none_f7adca24b5f66134\EhStorAuthn.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\f\lpksetup.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\dnscacheugc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimig.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.1151_none_329784a84ed43acd\wslhost.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\f\MBR2GPT.EXE 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1_none_bf56a5e7532d9c79\licensingdiag.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\recdisc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\f\SensorDataService.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\r\rdpclip.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_e6307765e4f96817\msfeedssync.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrmEngine.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\r\alg.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\CustomInstallExec.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\f\auditpol.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\WmsSelfHealingSvc.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\bthudtask.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1_none_afb33d8068b0adc0\ie4ushowIE.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exesvchost.exedescription pid process Token: SeDebugPrivilege 4432 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Token: 33 4432 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 4432 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 216 svchost.exe Token: SeLockMemoryPrivilege 216 svchost.exe Token: SeLockMemoryPrivilege 216 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exepid process 4432 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription pid process target process PID 4432 wrote to memory of 216 4432 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe svchost.exe PID 4432 wrote to memory of 216 4432 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe svchost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2023-04-29_18b14a8d32a1c4476dad96791bbee0a0_icedid_xmrig.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip\Uninstall.exeFilesize
3.9MB
MD5b49567b4125a66eff31ec4afb70bd81a
SHA13760348fafa22577b9e8355c11c219708242f8df
SHA25613c2e5dac27e109e3c275b0b990d47c678298bc14faae00953b0fee4052a269b
SHA5128b81127ddaea43ed617ff4db27d678bf17f312f32d7d7ce0cbf1696edabef2ab113c912a9a5bd7eedf060772033192bcd4ab8ccbdd05b5fd4c9835f2c3bf4189
-
C:\Windows\config.jsonFilesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
C:\Windows\svchost.exeFilesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
memory/216-523-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-533-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-416-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-449-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-538-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-525-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-527-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-529-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-530-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-532-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-353-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-534-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-535-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/216-537-0x0000000000400000-0x00000000004DA000-memory.dmpFilesize
872KB
-
memory/4432-133-0x0000000000400000-0x0000000000613000-memory.dmpFilesize
2.1MB