Overview

overview

8

Static

static

3

2023-08-23...JC.exe

windows7-x64

8

2023-08-23...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2023, 16:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-23_19d62ae9967554e1705aaefcb50b5b63_icedid_lightbolt_JC.exe

  • Size

    13.8MB

  • MD5

    19d62ae9967554e1705aaefcb50b5b63

  • SHA1

    bd7efed4e49da162684be0e29e781d8268420c9a

  • SHA256

    99d1d711f37401f45408c37adf208553b964a84940fc1e9f50bdd3598301ef78

  • SHA512

    1ec97d9232ae274783b3a55bd921b5a7127cc4a4ec04da1a49d4c6b8156f15a800b32ff8bbcfdd4b3a98cd4e0a7073d0b9ab76140695076ca68a65b6aa05d714

  • SSDEEP

    196608:wjWEjWWs3TehREvuI+kL2t0La3ZzpRvcV93dPT3E:ycT7vMkL27CV93x3E

Score
8/10
persistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-23_19d62ae9967554e1705aaefcb50b5b63_icedid_lightbolt_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-23_19d62ae9967554e1705aaefcb50b5b63_icedid_lightbolt_JC.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Uninstall.exe
    Filesize

    13.8MB

    MD5

    233dbfbccf48637e8335eb8ecbf36af6

    SHA1

    daeedc3026f75a3037baafad441b115ea0142d5e

    SHA256

    a954488d54e042b043d947eef754bb75532751f63249c3f2b322517e9910f31b

    SHA512

    049e65c523e922242fd58227eb4799a59a594375b7edbe24d5fce0bcc2cfe7c8697aa6a63adf95de2ed9dd60b9591e97dd2e97bb856d342fa7e1ecbff5419a2e

    Download Submit