Overview

overview

8

Static

static

3

2023-08-27...JC.exe

windows7-x64

8

2023-08-27...JC.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2023, 17:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2023-08-27_3d9af85955ad14d8cfd5091dde08c49c_icedid_JC.exe

  • Size

    6.9MB

  • MD5

    3d9af85955ad14d8cfd5091dde08c49c

  • SHA1

    ee2461dc354f5ff647ca59a70af189f4a5a3b07f

  • SHA256

    8f265df381ab5dc63a8def1167a489b8250ad643c25225f573ca95d61b4cee0c

  • SHA512

    f5f9778e5da2258e2277f5b43081a011ab822314e3b9b410a00ddc4401ea8d700a28b2ade7d0155cdcbd5d4001bfcdbbe603f5417582f9d9a1f4022d9ffa7649

  • SSDEEP

    98304:3+5xKM1Woww2E5T3DoXSG8kM8pNhS9Yw8y0C7V:wS7aTcXSL8Hwf0mV

Score
8/10
persistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-27_3d9af85955ad14d8cfd5091dde08c49c_icedid_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-27_3d9af85955ad14d8cfd5091dde08c49c_icedid_JC.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\Uninstall.exe
          Filesize

          6.9MB

          MD5

          2e50f25af79353407c5762b2ed006dac

          SHA1

          d84b6070d18240fd2feab6aa15e84fc2b2f9d3f7

          SHA256

          20e50be39d38e36745f2e2085ce7aa63e17d87f27205025c70e6b4d8d02a2d51

          SHA512

          7433c6d393126b0a43afb3c54139554a4e7a5088b8c8adcf73cdf4e44988e3d66485b1a10a327791090fb49a2c07bec1585e4b710b46c8b62bd14e311571f088

          Download Submit