Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe
-
Size
417KB
-
MD5
b6aa458d756f1a37d346068e736a6042
-
SHA1
7545ed299b467013b5c48a810216cf58ee705894
-
SHA256
1834dfb30145a8fbeb6f0ba5cdeec192f5308214b3f63f15fd684ecb3e6ee90b
-
SHA512
959cf896b2fa2cb4ef9b83c436900a84f4dd5a8d97b2435507b88337340a7bd2bacba6f3f06003533ee118e8c3b3630c8f4a7b33d03fc19104142d71a0290085
-
SSDEEP
12288:rplrVbDdQaqdS/ofraFErH8uB2Wm0SX/Nr5FU:dxRQ+Fucuvm0a/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2544 DirectX.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Installing\DirectX.exe 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 2544 DirectX.exe 2544 DirectX.exe 2544 DirectX.exe 2544 DirectX.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4408 wrote to memory of 2544 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 89 PID 4408 wrote to memory of 2544 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 89 PID 4408 wrote to memory of 2544 4408 2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-05_b6aa458d756f1a37d346068e736a6042_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files\Installing\DirectX.exe"C:\Program Files\Installing\DirectX.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD5839544abb87a6684a2af35e77ab3435c
SHA1b111cba28c18c7269d64a720dc895ab88340f869
SHA2562271275023a9681aeb929e8f4ee7c8535662cebe618685f3e5b0b9ab57088588
SHA5120e82bf3ba90a297c36ecfd36f860c1c539029841ffdf481c2a28f234671c5a98ed131b01fcef28b93b76d936518dd67ce556810d504b0631c3bcb4e860ee4bf1
-
Filesize
192KB
MD564c92711105a56d67878ef71a4ee61c8
SHA1e32c123751be82b5bc1396ee0b05df448fe361bd
SHA256c6f66b782318b8aba0cffd7da3d2db0285d3ff910ad7750d56dd685c164a20a5
SHA5128c4bceee0196088c68c3f05dda940817111ba883400ee3af920a617258ffcf6a2140ebf2c90732e232a4ea60f42a91eaf79a3dc3452adb9b7adbf278c6d84a25