Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 19:48
Behavioral task
behavioral1
Sample
2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
General
-
Target
2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe
-
Size
31.1MB
-
MD5
6f474b7399d12f4b728d53fddd9c8998
-
SHA1
fa1b4848320652cb35bdf00e13e93ffca463821e
-
SHA256
c44c590e1ffd7ee93d2c08c4a39981ba311a9949fb652f24d09dccc8a0d2ca16
-
SHA512
9777a9b390131189d8e6de38a2d87f49ee98a3e70a7fbd71d92c940ba110f1458cfabd3ba6cedd184e4dd01c52f3caf44463e07f1b4bebbba2d0e5707a28235c
-
SSDEEP
393216:dFgRavDllryzuhiQfKWiGo0PqbsBDT6t7:zvDllry2Lz56h
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/2212-0-0x0000000000400000-0x0000000000613000-memory.dmp family_blackmoon behavioral2/files/0x00010000000228b8-67.dat family_blackmoon -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
XMRig Miner payload 17 IoCs
resource yara_rule behavioral2/memory/2212-0-0x0000000000400000-0x0000000000613000-memory.dmp xmrig behavioral2/files/0x0006000000023211-7.dat xmrig behavioral2/files/0x00010000000228b8-67.dat xmrig behavioral2/memory/4928-226-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-335-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-395-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-396-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-398-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-400-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-402-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-403-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-405-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-406-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-424-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-425-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-430-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig behavioral2/memory/4928-435-0x0000000000400000-0x00000000004DA000-memory.dmp xmrig -
Sets file execution options in registry 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Tray.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Executes dropped EXE 1 IoCs
pid Process 4928 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\newdev.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\RmClient.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wecutil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\gpscript.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\icacls.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\netsh.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wscript.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\autoconv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\mshta.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\tracerpt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\sfc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\cttune.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\eudcedit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\GamePanel.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\cmmon32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\SecEdit.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\subst.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\control.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\dxdiag.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\ttdinject.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\typeperf.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\AtBroker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\calc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\certreq.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\ftp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\RMActivate.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\runonce.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\fltMC.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\fsquirt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\lodctr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\sethc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\net.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\openfiles.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\finger.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\Magnify.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\shutdown.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\dvdplay.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\mobsync.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\prevhost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SysWOW64\rasautou.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{BDAA48F7-DD30-440C-811E-DBC3EB54B114}\chrome_installer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.181.5\MicrosoftEdgeUpdateComRegisterShell64.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Windows Mail\wab.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\f\runexehelper.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.19041.1_none_13f5052244ba101f\WallpaperHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\f\SyncHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qappsrv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_389cd5270341e0a8\regsvr32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\Dxpserver.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_8b53de27def16277\eventcreate.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\sftp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\cscript.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\f\cleanmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\tracerpt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\r\wksprt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\f\MuiUnattend.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\f\uwfmgr.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\f\Magnify.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.19041.1_none_836cd009a39b05c6\NetHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_14f1e9e91239944a\MdmDiagnosticsTool.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\r\wowreg32.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\poqexec.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_228591433b6cf074\InfDefaultInstall.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\BdeUISrv.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.1_none_8bf94097c23f5fb8\MDEServer.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_b435e08254cda322\printui.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1_none_a78dc4e9f3c6c606\bdechangepin.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_e0dec3877978d84a\mscorsvw.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.19041.1_none_b79f30aeb967a64a\dvdplay.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\nfsadmin.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\Setup.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\r\mavinject.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\hvax64.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\f\wslconfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\UtcDecoderHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_vmconnect6.3_31bf3856ad364e35_10.0.19041.1_none_5c4ad75abbc47892\vmconnect6.3.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.19041.1_none_d570c31a162768ba\RemotePosWorker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\print.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\r\ThumbnailExtractionHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\windeploy.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.19041.1_none_3eb167e4f0e920b5\curl.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1_none_de83be952b0afb6a\RecoveryDrive.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\diskperf.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.1_none_5c82be53abe61670\PnPUnattend.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_56a3c953964ea509\WinMgmt.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_5dccefa0bb5ef60b\clip.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\r\ImeBroker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\SecureAssessmentBrowser.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\TiWorker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\rrinstaller.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\f\LockApp.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\MBR2GPT.EXE 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\f\setup_wm.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\MoUsoCoreWorker.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\MusNotificationUx.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\poqexec.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2212 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Token: 33 2212 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 2212 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Token: SeIncBasePriorityPrivilege 4928 svchost.exe Token: SeLockMemoryPrivilege 4928 svchost.exe Token: SeLockMemoryPrivilege 4928 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2212 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2212 wrote to memory of 4928 2212 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe 88 PID 2212 wrote to memory of 4928 2212 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe 88 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_6f474b7399d12f4b728d53fddd9c8998_backswap_icedid_xmrig.exe"1⤵
- UAC bypass
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2212 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31.2MB
MD53b5d9ba9d48c9085a61e7e753b9c39f3
SHA112fd5a5cc58b87ddf21d19d0130a360f5f08a667
SHA256d976984791ef2d0fc552af475528f68d63436b7eb62ed24504e56a077ef71d0e
SHA512ed6098c1042e8489895435d05f6b5361acdc02368e23f56c33d0eda2befb47dab11d425e8a26f8621dd07c98e1577a68def7dac95566b26a0376bbdc9699a8a0
-
Filesize
1KB
MD588c5c5706d2e237422eda18490dc6a59
SHA1bb8d12375f6b995301e756de2ef4fa3a3f6efd39
SHA2564756a234ed3d61fe187d9b6140792e54e7b757545edff82df594a507e528ed8e
SHA512a417270a0d46de5bb06a621c0383c893042a506524713f89ba55567df6e5c3ac8b198bce5a0300ec6e716897bb53fd3e8289a51240157dc743004517673d4ab7
-
Filesize
833KB
MD54a87a4d6677558706db4afaeeeb58d20
SHA17738dc6a459f8415f0265d36c626b48202cd6764
SHA25608b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7
SHA512bedd8ed4975df3fcd4a0f575d6f38e3841e7a4b771baac4f72033102a070818b8539eb101c50563d89d4f3454899a1cedb33047b02e421256dedf9aaf258b594
-
Filesize
83KB
MD5dbf7eeba754107a13a44298ad8ade2a0
SHA162d27ee4204b6159cc5cfb8ff9edcd72d1e9e737
SHA2560576a73bac90b6ea9ac61ca585516d8d2d8c0a1367ed5ff638f2650d43f875e8
SHA51275b5d38fe727c3bb9ffb16a8a23b48c59050d0b79be5fe3a50e29687716bd349bcb442efff37a8f53ca5fb44a5fe7cb0a83abb3df593b5fcb7a9008b03888fce