Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2024, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe
-
Size
3.5MB
-
MD5
21e693dd6cf7be3eef4887a0de5bceac
-
SHA1
49291d45ae4c16d6077b5849076c277ee84fab8c
-
SHA256
19abda2a390d0dbcaf019284a5b2a85b9ec6c847ca753b32f478189f49c4f9b5
-
SHA512
791046b4e0eea738b28212066f48583e53602bfa57a28ba4d257fc4650550f4674b73e398ed0a49ae0d82deb6ffa304a6bd4404f9b17578f73744c21c5d43d55
-
SSDEEP
49152:JCFzThuMHqCikNXSlW7sWVLRfGyyTozbsem:khhuraNXSE7sqo0Hsj
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/memory/2520-8-0x0000000000950000-0x000000000095B000-memory.dmp UPX behavioral2/memory/2520-9-0x00000000064E0000-0x00000000064EB000-memory.dmp UPX behavioral2/memory/2520-12-0x00000000064E0000-0x00000000064EB000-memory.dmp UPX behavioral2/memory/2520-42-0x0000000000950000-0x000000000095B000-memory.dmp UPX behavioral2/memory/2520-43-0x00000000064E0000-0x00000000064EB000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe -
Executes dropped EXE 2 IoCs
pid Process 1300 KYmJVs.exe 2520 KYmJVs.exe -
resource yara_rule behavioral2/memory/2520-8-0x0000000000950000-0x000000000095B000-memory.dmp upx behavioral2/memory/2520-9-0x00000000064E0000-0x00000000064EB000-memory.dmp upx behavioral2/memory/2520-12-0x00000000064E0000-0x00000000064EB000-memory.dmp upx behavioral2/memory/2520-42-0x0000000000950000-0x000000000095B000-memory.dmp upx behavioral2/memory/2520-43-0x00000000064E0000-0x00000000064EB000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\KYmJVs.exe 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe File opened for modification C:\Windows\SysWOW64\KYmJVs.exe 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe File created C:\Windows\syStEm32\KYmJVs.exe KYmJVs.exe File opened for modification C:\Windows\syStEm32\KYmJVs.exe KYmJVs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 1300 KYmJVs.exe 1300 KYmJVs.exe 1300 KYmJVs.exe 1300 KYmJVs.exe 1300 KYmJVs.exe 1300 KYmJVs.exe 2520 KYmJVs.exe 2520 KYmJVs.exe 2520 KYmJVs.exe 2520 KYmJVs.exe 2520 KYmJVs.exe 2520 KYmJVs.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2520 KYmJVs.exe Token: SeDebugPrivilege 2520 KYmJVs.exe Token: SeDebugPrivilege 2520 KYmJVs.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 1300 KYmJVs.exe 1300 KYmJVs.exe 2520 KYmJVs.exe 2520 KYmJVs.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 712 wrote to memory of 1300 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 89 PID 712 wrote to memory of 1300 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 89 PID 712 wrote to memory of 1300 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 89 PID 1300 wrote to memory of 2520 1300 KYmJVs.exe 91 PID 1300 wrote to memory of 2520 1300 KYmJVs.exe 91 PID 1300 wrote to memory of 2520 1300 KYmJVs.exe 91 PID 712 wrote to memory of 4036 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 92 PID 712 wrote to memory of 4036 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 92 PID 712 wrote to memory of 4036 712 2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-28_21e693dd6cf7be3eef4887a0de5bceac_icedid.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\KYmJVs.exe-auto2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\syStEm32\KYmJVs.exe-troj3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2520
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" > nul2⤵PID:4036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD521e693dd6cf7be3eef4887a0de5bceac
SHA149291d45ae4c16d6077b5849076c277ee84fab8c
SHA25619abda2a390d0dbcaf019284a5b2a85b9ec6c847ca753b32f478189f49c4f9b5
SHA512791046b4e0eea738b28212066f48583e53602bfa57a28ba4d257fc4650550f4674b73e398ed0a49ae0d82deb6ffa304a6bd4404f9b17578f73744c21c5d43d55