Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/02/2024, 02:40

General

  • Target

    2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe

  • Size

    2.6MB

  • MD5

    b26f10684596e3a8e5cc348c68758f6c

  • SHA1

    dfe4aedc773f047800ec2281801c841353d58b66

  • SHA256

    eb76c053d043bdd6cfece2499e29736bfe052ee63bf481a04bd7654f4e56a607

  • SHA512

    bd4ac515e718606c3d1c78d2d44d46a386af1e3b61b6a36d3375122b3acf547c05eee83d194dd5524cc719579821e515844d49509d956587696b0bda741f6b64

  • SSDEEP

    24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6LH:tl1vqjdPQRw/D4mizA0dizLrB51ve

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • NTFS ADS
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe
      "C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1548
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 C:\WINDOWS\Media\ActiveX.ocx /s
      2⤵
        PID:2916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe

      Filesize

      642KB

      MD5

      d871f2c4088b8b4044a06352378e5f47

      SHA1

      1ac52a4fa15aaee20307c475ff0ef95351418074

      SHA256

      bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa

      SHA512

      294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68

    • C:\WINDOWS\Media\ActiveX.ocx

      Filesize

      12B

      MD5

      bcc03c960fe604013ada79c7b5d10d56

      SHA1

      5243768689ce69f1160df9adf0a6fd4e9ec93aa2

      SHA256

      eba28f70de81105a4cbcf282bfb2e6cecf1b0290e2ff303367b3d8f2197d462a

      SHA512

      f7135497a66e97e297d5521d52115123c436a5801614c803d46c37be183c21e067298724c4726a9e0a0c43bfbf4e925c5076d745408bb8603036ce6ab731f09a