Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 02:40
Behavioral task
behavioral1
Sample
2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe
-
Size
2.6MB
-
MD5
b26f10684596e3a8e5cc348c68758f6c
-
SHA1
dfe4aedc773f047800ec2281801c841353d58b66
-
SHA256
eb76c053d043bdd6cfece2499e29736bfe052ee63bf481a04bd7654f4e56a607
-
SHA512
bd4ac515e718606c3d1c78d2d44d46a386af1e3b61b6a36d3375122b3acf547c05eee83d194dd5524cc719579821e515844d49509d956587696b0bda741f6b64
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6LH:tl1vqjdPQRw/D4mizA0dizLrB51ve
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0006000000023217-2.dat autoit_exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\WINDOWS\Media\Desktop.ini:dbase.mdb 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe File opened for modification C:\WINDOWS\Media\Desktop.ini:dbase.mdb 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe File opened for modification C:\WINDOWS\Media\Desktop.ini:dbase.ldb 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe File created C:\WINDOWS\Media\ActiveX.ocx 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 3 IoCs
description ioc Process File created C:\WINDOWS\Media\Desktop.ini:dbase.mdb 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe File opened for modification C:\WINDOWS\Media\Desktop.ini:dbase.mdb 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe File opened for modification C:\WINDOWS\Media\Desktop.ini:dbase.ldb 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe 1548 64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2716 wrote to memory of 1548 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe 85 PID 2716 wrote to memory of 1548 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe 85 PID 2716 wrote to memory of 1548 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe 85 PID 2716 wrote to memory of 2916 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe 91 PID 2716 wrote to memory of 2916 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe 91 PID 2716 wrote to memory of 2916 2716 2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_b26f10684596e3a8e5cc348c68758f6c_backswap_icedid.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1548
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\WINDOWS\Media\ActiveX.ocx /s2⤵PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642KB
MD5d871f2c4088b8b4044a06352378e5f47
SHA11ac52a4fa15aaee20307c475ff0ef95351418074
SHA256bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa
SHA512294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68
-
Filesize
12B
MD5bcc03c960fe604013ada79c7b5d10d56
SHA15243768689ce69f1160df9adf0a6fd4e9ec93aa2
SHA256eba28f70de81105a4cbcf282bfb2e6cecf1b0290e2ff303367b3d8f2197d462a
SHA512f7135497a66e97e297d5521d52115123c436a5801614c803d46c37be183c21e067298724c4726a9e0a0c43bfbf4e925c5076d745408bb8603036ce6ab731f09a