Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2023, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe
-
Size
261KB
-
MD5
943bc976ab76ee9b1e602decfadc0a2a
-
SHA1
6d51edb3a5b91a8dafbf2aa2ac9748cf5a34cd44
-
SHA256
49caa705232a5404c985bdec5d92dd1ac6647a031e4664d5c18fe15e497630bf
-
SHA512
6e89f61dd229ab1e588116c0c2e47d39c55913433a0635fea0c1f9a8c903fd3d42b79c9d7732f2cd20b4c9d4335bdbb94bc40e5a9642c85fb4fb264f94ac5c80
-
SSDEEP
3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3508 verify.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\code\verify.exe 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe File opened for modification C:\Program Files\code\verify.exe 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 3508 verify.exe 3508 verify.exe 3508 verify.exe 3508 verify.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1256 wrote to memory of 3508 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 82 PID 1256 wrote to memory of 3508 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 82 PID 1256 wrote to memory of 3508 1256 943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe"C:\Users\Admin\AppData\Local\Temp\943bc976ab76ee9b1e602decfadc0a2a_icedid_JC.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Program Files\code\verify.exe"C:\Program Files\code\verify.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3508
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD54bce72d2a0df966fc87dad8f8864b931
SHA1da41079cfe65eefa1de2a6294c9139ef5626307a
SHA256829e835e538c351f6d785fc1ac81a77b54054c65949e1164dcf5205871ac8ab9
SHA5125c7c8a36232f59e9396ddcdddc8f209922af4d8672b4c21e7774e0e92757a4b7777d5665354cf553b2857fdda21304259514395a65e540c22317537d88998e6a
-
Filesize
261KB
MD54bce72d2a0df966fc87dad8f8864b931
SHA1da41079cfe65eefa1de2a6294c9139ef5626307a
SHA256829e835e538c351f6d785fc1ac81a77b54054c65949e1164dcf5205871ac8ab9
SHA5125c7c8a36232f59e9396ddcdddc8f209922af4d8672b4c21e7774e0e92757a4b7777d5665354cf553b2857fdda21304259514395a65e540c22317537d88998e6a