Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe
-
Size
385KB
-
MD5
61e13b59fe058aa57f46a61e219799da
-
SHA1
dac27e1147b06110d6b59d8a0ddadeaadf67bff4
-
SHA256
956957afcbbd19f7b70977331ea65866ed849ec06c61688a60afd6abaeac12bb
-
SHA512
2553442c3c2a7ab135e13d20febc8b8283fd327276a4006d538b86ff532a54a74b790fb3e5c4f704e2e218a303bbd8b7cffdbad636eecd7c64a23bb0b227b7ac
-
SSDEEP
12288:XplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:5xRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1728 Education.exe -
Loads dropped DLL 2 IoCs
pid Process 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Inside\Education.exe 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 1728 Education.exe 1728 Education.exe 1728 Education.exe 1728 Education.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2076 wrote to memory of 1728 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 28 PID 2076 wrote to memory of 1728 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 28 PID 2076 wrote to memory of 1728 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 28 PID 2076 wrote to memory of 1728 2076 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Program Files\Inside\Education.exe"C:\Program Files\Inside\Education.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5d41beecc4235d535aaabd738fc23cc4a
SHA1f1ada4ea2d3bc4bcab54da698cc4247aaca9c2f6
SHA25685586f2168a710f899249d8921940bed4a9dbd2f63ab1b5b3f22e05d7db8ae33
SHA51297fd7779d6927215a781feec45c9a0c8d4d9b0388ad3154aa1ea1a7a83a53f1fe3bdefe2a7a92fe755fd35a5ea0ffda75de788e199de9c01ea5a32e824753be3