a396460645a9bfbd911333200a3536a2a57c6138eacec995c5836d0abf2ef279

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 03:02

Target

2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Size

1.6MB
MD5

0bdaee0da97d0feeb497690888dfdfe0
SHA1

6693d21f8b60d30cf9e954ddfc6718f152b7f202
SHA256

a396460645a9bfbd911333200a3536a2a57c6138eacec995c5836d0abf2ef279
SHA512

fc55c066519be654d78e9a280a360923ac57118920a2899d0ebd3e1c66316ea429fd53eb53d8dc1dc6622571fd6a4591ba13758b8d21a598f5bf019c7eda34ff
SSDEEP

49152:wu9lLAC7wZUn7+TBCHgv8d6N7HP/mO6E8O+nVr1IGmPqGUP2TCYAO+rdhcJ:wqCC7wM7MGgv8INTP/mO6E8XB1IGl+Tp

Score

1^/10

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CNC	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CNC\ = "CNC.Document"	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CNC.Document	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CNC.Document\ = "CNC Document"	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CNC.Document\shell\open\command	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CNC.Document\shell	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CNC.Document\shell\open	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CNC.Document\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe\" \"%1\""	2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_0bdaee0da97d0feeb497690888dfdfe0_icedid.exe"
1⤵
- Modifies registry class
PID:3052