Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe
-
Size
273KB
-
MD5
f6eaddfb52fc5ef1a1006bab80a80415
-
SHA1
94d6d70483afe781bc9947205544a07ecbe956e5
-
SHA256
5b4f542255781d7ea091cfc321538b6f3aee79fc2eb4397dd684c5d94e41b6e8
-
SHA512
03d05747d0373664434afd2b1068238eab494b992ff42f711c0de44b05dc821eb350ac52c68d5099fd50ba32fd410874e71917e07af8ccec6bf8917238079578
-
SSDEEP
3072:lxUm75Fku3eKeO213SJReOqdmErj+HyHnNVIPL/+ybbiW1u46Q7qV3lU8xM:fU8Dk11CJ1qDWUNVIT/bblS9x
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1696 .exe -
Loads dropped DLL 2 IoCs
pid Process 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\.exe 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe File opened for modification C:\Program Files\.exe 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 1696 .exe 1696 .exe 1696 .exe 1696 .exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1180 wrote to memory of 1696 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 28 PID 1180 wrote to memory of 1696 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 28 PID 1180 wrote to memory of 1696 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 28 PID 1180 wrote to memory of 1696 1180 2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-23_f6eaddfb52fc5ef1a1006bab80a80415_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files\.exe"C:\Program Files\\.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1696
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD5e7d3d703f8c2d8e552f513f768f91e31
SHA14e78d7b93a2e50491987ca232f8457aa613a3a2a
SHA256a6023ce6d11a782bc7b9e4626ae1889179d40dc61b8ae3e29a1e53c98d10a2eb
SHA5122e313c50b0b7c2cc5da550a142694c87d1ff8e0a7a2686f1b0ef4419c28c7d0a2d90776cc202d5e92b22c2eb4a88ea14379f6a423cafe03373c09013d8b30687