Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe
-
Size
268KB
-
MD5
65a0003ff62b0e6489452e6b03c150dc
-
SHA1
2c12bfb9509400ae26bdc4e43ebf2678f62ceefe
-
SHA256
fe8fba4ce816927ebe606de57972172e1b5cbf79d0c60fde58c5490e85b9736e
-
SHA512
6b14fa2003405ad1ec352e0dcd0984237e2f0d8b9bb8e545328e12d433f750034287a4f3f4e5fd27ca6a50226abfaa7bbcfa63f6b7d8a92f5d22b72e4edf01ed
-
SSDEEP
3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3616 Standard.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Version\Standard.exe 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe File opened for modification C:\Program Files\Version\Standard.exe 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 3616 Standard.exe 3616 Standard.exe 3616 Standard.exe 3616 Standard.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1856 wrote to memory of 3616 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 89 PID 1856 wrote to memory of 3616 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 89 PID 1856 wrote to memory of 3616 1856 2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-16_65a0003ff62b0e6489452e6b03c150dc_icedid.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files\Version\Standard.exe"C:\Program Files\Version\Standard.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3616
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD5ac4e5a6bdac5fdc78293ee0a83366589
SHA1acdaf5be8c7d97125f991945f3f2ef688b4c162e
SHA25682bf23e3e3e00b7cbc7ef681404f2a9c3a76fd97e9ef03a6d17b17ccfeb39e80
SHA51224aa4ba48c5b32e18146d06dc66ff7a40dd181d069723bb59b44cc57764bd550982d38e485d9401df7e184d5d747b9ca688117dbeb87a7dcfcf2dbf71a2499a8