Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/04/2024, 10:49 UTC
General
-
Target
2024-04-09_9900eb957ec315f07a003b15cb2dd1a7_icedid.exe
-
Size
1.8MB
-
MD5
9900eb957ec315f07a003b15cb2dd1a7
-
SHA1
8c667cb4822dab1bc8066708ac2f00c341c2959a
-
SHA256
085316461f1fbd5850118b8f882614e863fa0d8e93a14afdd918c8f9d32fbaa2
-
SHA512
e95e1b0cf5dd4688b5eb20786f79f12b84aea94df52f4f58723f75a72dfc567160db7eae2e8f2cf01a5b7dedc5976291b60ada9dec8746b9fcacd9bef309a86a
-
SSDEEP
49152:s82pIdCow0gV+Hig/9LjiHGXBrKb/X0Y:d2WdCow0i++j
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 16 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-09_9900eb957ec315f07a003b15cb2dd1a7_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-09_9900eb957ec315f07a003b15cb2dd1a7_icedid.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵
-