Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe
-
Size
385KB
-
MD5
61e13b59fe058aa57f46a61e219799da
-
SHA1
dac27e1147b06110d6b59d8a0ddadeaadf67bff4
-
SHA256
956957afcbbd19f7b70977331ea65866ed849ec06c61688a60afd6abaeac12bb
-
SHA512
2553442c3c2a7ab135e13d20febc8b8283fd327276a4006d538b86ff532a54a74b790fb3e5c4f704e2e218a303bbd8b7cffdbad636eecd7c64a23bb0b227b7ac
-
SSDEEP
12288:XplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:5xRQ+Fucuvm0as
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4524 DirectX.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\Installing\DirectX.exe 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 4524 DirectX.exe 4524 DirectX.exe 4524 DirectX.exe 4524 DirectX.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1504 wrote to memory of 4524 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 99 PID 1504 wrote to memory of 4524 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 99 PID 1504 wrote to memory of 4524 1504 2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_61e13b59fe058aa57f46a61e219799da_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Program Files\Installing\DirectX.exe"C:\Program Files\Installing\DirectX.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:3800
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5ae57ba2ce4cd9a0f78128b5ab09693cd
SHA13a2836bb0a826c19c8a05bbde3916f982fcadca3
SHA2564c0aee95c0579da6e078930a6bb92c0147fb5637b4bcc9c6b38c2b96c978307f
SHA512cfa0ece490e5f9134f48f24349003c049aeb2584a3fda48eca5b43e1e941e7efe6f870983b163486e85c07a6bd9c3d22c542e891d56669d7f0ef1802fb948c19