Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 13:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe
-
Size
19.4MB
-
MD5
718640806ceb2660d1a7084d9fd3ae02
-
SHA1
6dff1ee0df215948bc25baa321529e0f1671dc2b
-
SHA256
fcd1040799c4619e477088aafc031027fee4638b5bdf4960fd47660921f1de89
-
SHA512
7d3ff1bcf5ca9c766d97f44c20aabf4ef6a0c649acb756b4c1814d553f868c16facd691a6008026a77d72fbb6b2d2b80fb4cdbaed5fd250b3de82be61e81b2eb
-
SSDEEP
196608:LTjXRy4LUL8AaTjXRy4LUL8A76DPRw/PdVqiWn5V9z8JNeWnRPZTrx2TjXRy4LU9:ty4LULxmy4LULx76lVCNUy4LULxeDqBz
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\s.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe" 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jjs.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\klist.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\ktab.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\servertool.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\7-Zip\7z.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmid.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jabswitch.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\orbd.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec.exe 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe 32 718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\718640806ceb2660d1a7084d9fd3ae02_icedid_JC.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:32
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.4MB
MD563a4bc4f6d74d530dcbf45207e9ca1d6
SHA16a45a90520d6570b1529d3bd8c7d3178a08b3908
SHA25655f00bc062c8b0fab6728cec29e60e54775099936b19141e82aaced0aa575492
SHA512c2b4bd20c1d15d3979365953a9d1826912bede0b32bf3ad3474b9d39a31558de0c634ec4372f0440e2852e5f4a8435ab41930a789ea25aeba58ca8ac6c2958da