Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2024, 05:58

General

  • Target

    2024-01-11_50f47788c6f7f6a754b7214643cee901_icedid.exe

  • Size

    424KB

  • MD5

    50f47788c6f7f6a754b7214643cee901

  • SHA1

    6157b2bc63f46d0a583779a087a0dff6aa153d6e

  • SHA256

    0247532408ae45b30357a07ab1a94fbb272fff188d704417e3ddd00cd6e3de49

  • SHA512

    ebc93528bbc28c663055849c89a5c8ca835dc1b8545c05d5fac399dd8ae87a2b574c4535e23e1ddc6a8ba919d6ce687e20bced7618da2c710ffd62058e1dbc07

  • SSDEEP

    12288:oplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:UxRQ+Fucuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-11_50f47788c6f7f6a754b7214643cee901_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-11_50f47788c6f7f6a754b7214643cee901_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Program Files\thatcomes\withthe.exe
      "C:\Program Files\thatcomes\withthe.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\thatcomes\withthe.exe

    Filesize

    424KB

    MD5

    3b27f2d38ab9104190a19a1d39f86f57

    SHA1

    5ccf7842beed87c9379a182d4297df7390c18d90

    SHA256

    cb1bb2ab8b4ac08c6bef203379669b46e8a5df515c243c2b4b3f8129c5fe69bb

    SHA512

    b857362dbeb7a2ce67de29f4c590a751650b032830fb684edfb139ba5b4365b27de7fd44ed5998bf5e4995de6142d752100fb02c8c8ad18fee061134350a634d