542599061b07c2e5596e1933215d789dfc27fc9dbf4720c9bede1626865abc7e

Analysis

max time kernel
200s
max time network
206s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 21:07

Target

2023-08-25_b2ae36f6535571782e1a041e4b8b3c11_icedid_JC.exe
Size

984KB
MD5

b2ae36f6535571782e1a041e4b8b3c11
SHA1

846f9e76f384930ff3388f1bfa46130bf775ae0b
SHA256

542599061b07c2e5596e1933215d789dfc27fc9dbf4720c9bede1626865abc7e
SHA512

8cd910200f0471d84bdc28f0ccaca513eb5bc18b83c243002955d3487ae99017f45139424073f81375d80ee32090221896ac845b1337c3f05f91d466cab3226b
SSDEEP

24576:jTdjh07j1xOl4oGvdzCUz88eFwL6XEdCX/xXEfV:Jh07ul4oUTztWQ6UdCX/xmV

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2768	2023-08-25_b2ae36f6535571782e1a041e4b8b3c11_icedid_JC.exe
2768	2023-08-25_b2ae36f6535571782e1a041e4b8b3c11_icedid_JC.exe

C:\Users\Admin\AppData\Local\Temp\2023-08-25_b2ae36f6535571782e1a041e4b8b3c11_icedid_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-25_b2ae36f6535571782e1a041e4b8b3c11_icedid_JC.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2768

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact