Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe
Resource
win7-20240220-en
General
-
Target
2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe
-
Size
284KB
-
MD5
5ef445daa7878ac15623e8178961a6b3
-
SHA1
448ce6eccda4e14884c9b7cfc8fd70819e2ff132
-
SHA256
692c60c6e3f7efd735d067978145e67f74292c239dfa3788038299eb359337d3
-
SHA512
a834426e45d47a45303ed069e313dd7a9543148275642ac1e101dbf97b48f129f172c2571b46163be5e69874ce6a26c49b3e944c028cd3da4cdccbc7486b7e88
-
SSDEEP
6144:blDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:blDx7mlHZo7HoRv177ePH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3320 sethome6859.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created \??\c:\windows\system\sethome6859.exe 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe File opened for modification \??\c:\windows\system\sethome6859.exe 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.baiduo.org/" 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 3320 sethome6859.exe 3320 sethome6859.exe 3320 sethome6859.exe 3320 sethome6859.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3836 wrote to memory of 3320 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 99 PID 3836 wrote to memory of 3320 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 99 PID 3836 wrote to memory of 3320 3836 2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_5ef445daa7878ac15623e8178961a6b3_icedid.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\windows\system\sethome6859.exec:\windows\system\sethome6859.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk
Filesize1KB
MD50191104e1d5e2fb4f19d7ed7a6b4cdf8
SHA151f3ddeea8605de4788f9c41235ff5b8915bdf4c
SHA256c38d7e300d5ab6b184ccd5ec9f4c3aa95cce8238910cc1cd67cca2b74abfa1d0
SHA51220a7014eef977f59342d334cd1390ec4984046954f5598e46b0c306120c6ce8f2e74348f539bc3b70ad300168cf0bafe8fb668a56aae54a7674f7cd7d2678f5c
-
Filesize
1KB
MD5acf0bf91b47dcaf2c95dbf1057359497
SHA1e96b0926d55db75dff64ea55797ed8dd95d40800
SHA2566525f4957fddfb11b7bfb5a34f27b95e311ba9d84a5f25d15f01012b2f9e30f6
SHA512925055b170b23580c070261aa2a6ce7ad31f67fc2ce86edc76bb2b45f88a106518108760fe88074708f97c190bced6e3bd79ad1d5953d096ca8b437be8ba5787
-
Filesize
284KB
MD53cf8fdd3231288d57751ca03689ad5ce
SHA1412ec9f560e8a55dbd8bd814f5f805a8df79d617
SHA25651e375e0887c2d20c30788c3c08a0471ec04e77e363bfa9c0706776d0f90a920
SHA512f75c6e8a546e52f8533ee4f7f92626263ba4ce58bcc963cc255db979ede6da429d4abbff644839ae32b84e3a882e4817c429d70270ef207895faa9ab768c3236