Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/04/2024, 14:43
General
-
Target
2024-04-06_b6edec3676c48272aace0eebfffa3573_icedid.exe
-
Size
284KB
-
MD5
b6edec3676c48272aace0eebfffa3573
-
SHA1
a1c315bf34a28aa81197993a294b26e52a47a195
-
SHA256
bff511ebe1b5836258f15349bd0c90253625b4a6db0a095c8576e30ab7e6a025
-
SHA512
76a4c7b1c9e7e6d1ebc43de591caafb13dae8c08cf13f113f3200a7243dee1b97bdbde9cc55219f7b412f700701811a89939567f9dc9a930d7524051189f102e
-
SSDEEP
6144:klDx7mlcAZBcIdqkorDfoR/0C1fzDB9ePHSJ:klDx7mlHZo7HoRv177ePH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-06_b6edec3676c48272aace0eebfffa3573_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-06_b6edec3676c48272aace0eebfffa3573_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\sethome3079.exec:\windows\system\sethome3079.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
965B
MD501efbbd4786ad963d1661b7348cde92d
SHA180ad7d7ffb9d44a1090dfd815ce28e749b941715
SHA256d58c8ca40e52afc97df5aa2788edf5acf13a26d79ada22e6a34b46f17fc7fe3f
SHA512a191e2e9852dfbf08ca9045ba23068398280f59a38c2479389266dc0c42908913982dfbc753ef2cf848185bb091b85965cb1b66169695dbd4876d7af47be53ed
-
Filesize
1KB
MD5960222e44ed24baec5ab0933a3628fe8
SHA188eecc03d7068a89a4910207be9c3ff34eb40148
SHA25620c8f24b0a4dd23b6364675b64199ee8a318b8325dedb96a3280cfc4cfa485b5
SHA51210c127a4e1b77a5204d1712d7e4e3c70d448343493dc2cd9b3dd8d6796133790ea63bcadf4fd1cc7f8a952216ba8d0cc3de3c403a2655e351db4432823007722
-
Filesize
1KB
MD52ade9bf687f24cd15c14ff4b394d61bf
SHA16e908c41934c8ec1037aee6911813396f02ffc6f
SHA256eaca14500e7c68dfaa6c3d47dea6a80dc9f9a4e5f943204d733b347debe75aa6
SHA5124c8dc0748bcec1c6a9ff4f266e258501f1d1045fd1478af49bfa199d4ef533f7da8d189006418bb90d22249a986fe3058c283ccd863cce87f56020544438ba48
-
Filesize
284KB
MD57b79bf9917c18ce66cd022f721b6cb98
SHA148424f0895a20aa4a63ec29d52452a34154c9f65
SHA256f9e05c1198165f9de0c2ada3839af32e192099db9bdc2d35ef2d9826f533dd30
SHA5121c242421832d691c9adb1d43eb489eab4ebc864c86816de4f271720eac4772fa51536ffd6ac891acc609f18df622965928917ef409cd460c6aa126dd2c1c8004