Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-03-25...id.exe

windows7-x64

7

2024-03-25...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/03/2024, 22:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-25_2d76c6f9ce4b5d7378a3ed79bd90651c_icedid.exe

  • Size

    317KB

  • MD5

    2d76c6f9ce4b5d7378a3ed79bd90651c

  • SHA1

    a8a5bcefb16bcc19069fdd6613e1ad3dd42f84bc

  • SHA256

    b21021005c576a2a893fa07a82489372b0059ed3c7f97a647cb7d91a5cf1ecfd

  • SHA512

    9dd56fac2b58013df88c3b96de9a86e7856dcdc76a49475be173e5bf1d41f4d4f9a7433d6e8946f1d465ddb038d0ef85b7c1e432071b38f952974e852999aea1

  • SSDEEP

    3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-25_2d76c6f9ce4b5d7378a3ed79bd90651c_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-25_2d76c6f9ce4b5d7378a3ed79bd90651c_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Program Files\code\verify.exe
      "C:\Program Files\code\verify.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files\code\verify.exe
    Filesize

    318KB

    MD5

    b7324539527b3a81158c5f828a2c5232

    SHA1

    fcc5909ecdbabbee542484dd6d7f5274652651e7

    SHA256

    6a5254a1ffa957ba65491d228b7b17b78df536d1b9098ddfb7ea075d03568cdf

    SHA512

    be517bade090ce915bd40311b4d012782cb7b146e5453334ad948d43cadd68682e18529f616ac1e308b4746945a77839bf0b08d0afb238658741ac76d029d7f5

    Download Submit