Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-04-15...id.exe

windows7-x64

9

2024-04-15...id.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 03:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-15_d56308409b751ec4c5897fc401ca502d_hacktools_icedid.exe

  • Size

    5.0MB

  • MD5

    d56308409b751ec4c5897fc401ca502d

  • SHA1

    5688ac0622b9534712a95304f929ca1285dbc6ba

  • SHA256

    b678fe5bca1dd3c4a87a745526e88feb45991ecf1e0e9430a0f2d3c919202c7f

  • SHA512

    b92d4069717da405fc6fad49a39efec352cba996466a28880937954548f4b9b9af55a3768b211b79bc0d1b8b83cb925ba1d83ecea5b7b9f0b8a28561baeea355

  • SSDEEP

    98304:nHQHLSfJPzdUooYYqdwkLcHHH/Ni2nrhYqdwkLcHH:WcPl3jAHMCjA

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 3 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-15_d56308409b751ec4c5897fc401ca502d_hacktools_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-15_d56308409b751ec4c5897fc401ca502d_hacktools_icedid.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://x5yz.top/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1dedea408286607d80368d15d4e06ee1

    SHA1

    ba52b88285f624d63ab292b4763ff5caa82fd052

    SHA256

    fcbbf0f1bde4a65e467e59f3c78e283beb7c1d60e6b3969bbc916ae813e7124f

    SHA512

    ba39a666d27db6cba188eede7d55b45788532eab610a290a8136619ca589e2fa546bbe8e1d0061a6215e38dfc88031d54d3e0bd86264d36b2c138d019b9113e4

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    e3383a7b232c8eb79d5bbe4402c0f908

    SHA1

    bbb389559c8dcecd4ac43c509ee0340b15145852

    SHA256

    214170f61da2c9dd9ddb60313e7ace16c114af889d72d86d7637e32b64a9ac48

    SHA512

    04d44ec71b69f5d98e0513c01369a7286070518338994b424b5422778353e84b161169d3f6fd4b7e402fd5010299b1f3bd37f442ac40f5f8dbaf848361043623

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b5efbeeaca7b79b536d43425147d9a1a

    SHA1

    959370ee792aec1edad2e8dbd56c180a1c875a75

    SHA256

    bcf23af4a7938f8f04fed4a53d5f8eed2fe5a1dafda04cef5b9bdfad35cd9f29

    SHA512

    78c63aee2bbd8f5a2a0f9b7da636e4e1644a5b129cf66d45e9a6b3dbe3faa406521af513417add34e05b808c4a4991fdc5b9c992042bee10c27496e934b18b06

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4f0cc65aed2587330d240751eb88a531

    SHA1

    7d80ae0d71046d70ad669cc64e51ab5663b7330d

    SHA256

    ca79957ac29526f7de7ed4a98de3ff41e76bc4c0fbff654179729794cf7ffaa6

    SHA512

    0360b46750f18beb2e099dec4142dc4ddb81c4241dfb7c16bb61f68af7c63a672c433a7ed631affbe6283053fcf1603a535a3c45f695e85b40803dcc74ef8161

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    afd204947ce6a0d05f869b2d9fe5a12b

    SHA1

    b27056ec35dde4398f1924ddbee09b633a03136e

    SHA256

    eaad37a13dccf56f90c885fd86389caa948bcf927fea5f86b9fca5729fe68c57

    SHA512

    d50e23ad8445d7a8dfd5af01c61dacc5a16490eb0d7bc90a6231899c2046ed176f088124e27c732ba6ca96aad359d3941e3fdb4fc251e6e0326275d06eea6f65

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    9603a6e91cff25f9d725f7ce5707f0d7

    SHA1

    28bb37bd2b33481f6dc7389dcb199f79ef21e589

    SHA256

    b4c37bbcc5d1b021b8619a217a6cf8083c47b905b196d05b886f87482cd83d4a

    SHA512

    fd6e4dbf7019831719c1cc69c3cf0ce0f5776cfe19e91fdb4e91098c5b247fa15ac101b3f8ced5237cc7908c9e4cdd1aee3d56264811bc91dad17098e7c2336b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1298a89c4c66ab3280d635d8a1df29aa

    SHA1

    a0ff5c9bc69302185b5e755624e1751cb4d75fd2

    SHA256

    13035cb705e980c951d09c03ab45340a2c9fab99c24d7b9b16a00e56ebb597a9

    SHA512

    c8a8e23a3d2975f69a804b84da6ad2f5b1cccf267c055a9e1bbf296785631ca914d496a5f26988de1906191f157f307984d93c9b0186a3b2cdbf45be6b22c712

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    2240d65ad0968f499ef9eaae44eb42d3

    SHA1

    b32e218741275aa6b8dbc64f1ba00dafe4a9b470

    SHA256

    3fd83f025bbc3024ff2d4bf7b7e5ae82c599da0c5f87311f827ee38c870ae906

    SHA512

    9f10bdd4e0713304aab67c39f2667ef920a48b6507bed5746fec7e8c47cc648b426020fbf449e1fd5eef8ac4ea624506391f183142b7eef41fa026f0b66dac6b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    01c74f4bef294a994883245b0b62c06c

    SHA1

    e606cd688cb85354ad9fe2e52b1788b23f9bc536

    SHA256

    ef775bcb9885ad0ab4ae21405695ad7fec3edc4efc2555f37325ccc038d117aa

    SHA512

    b8bd3ceba6c7339dc3898d65709ed165a5636cc01ec7c06e758505c742682d1fcb7628e137548777e6c8bf1914d4766e7c93b5305fc54918472ccdd6791ae74a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    111f57ba70665e4ec1fad59c6304d1c6

    SHA1

    a140b76cccc64007f9f9f18db1095f778d0cee6e

    SHA256

    9d06c4d0b0503a4074d9da0835ee52110cdebf476094589a70999a281e1509c6

    SHA512

    457d89087fee34846a09a316bd55b656296fc92814015d1660d4aed3236398d47f3d78b7671dcf0912a5eb1298d3ccba0bae886ef00dea44327f0f667aa9dd2f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    e1cc8cec162c1c4a12fc99c012ea0ad9

    SHA1

    4932707cf29ddd42a36c5a33cdd38cf846363635

    SHA256

    7d0147d5fe6aea1d9469ac39a821dc4c5293fac33a361edbdee1cd31138ce4c5

    SHA512

    e9876d366a82845b247b26ec2b3d2b661bb81ac0288e1b0640977a2096e24a84d03029d2c6cfca7a8b0844901274018498ae5514097184e6b7c0129aa6379505

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1822676d3aabeb84adbdd840a5b8ccef

    SHA1

    5769f5983e3d6f8db9846cd46f6936471a5914ec

    SHA256

    11ac38d3c0df41494423d697d29d79faa2c01268f643f2a15a7d00d4c23d0329

    SHA512

    dda28470b412cd0526cf10e5612e1000ef2de6cca6d6d78a62108550266563803af0b7dfd946304da89272dbb6fa38147af688d57853f642ed313dc0929a9ac9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    e1815ccf8a9f2a622f70b2e3a2cc9de9

    SHA1

    c8de73d2983270e80db7568d7be822e75879192d

    SHA256

    5038d6ec9cf5f56750df67be3727b89eb532950cebc13b712e8a5bc429cfa4c0

    SHA512

    861eadd16b75ffe75a6fc44a778624cf57bc138f359fa1d0e84ea07bf87ddc28b74e887039d9695270d71b26fd043cf0f5b32088c736a66656198f1bdccb175e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    5e05ab693560016242060594b5f8cdf5

    SHA1

    644f94f175dbf5ad38b49b9e8662d06195bb665c

    SHA256

    1062b9083c5c98151df75863a063b799a7702bdb2621484c3b6ed68c5d8dcd88

    SHA512

    914c95cf0c1f1b53951250425a9e83db10d2104817f4aab074831d67b7f3710701500a984245c80fdfa6285292e18656a644835eab6d15c1bc0d52e2f39a7744

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    95a660f4b9692efc294c514fa0a6a5d8

    SHA1

    570dcd34fa18fe98e79328b8240e5c34de740ea5

    SHA256

    d327bd2720133f2fa65569340a14abea702f6f53d922e2f4fe2990bcd5f8e997

    SHA512

    b1c8eea220c9875e9a1d32327d245613da8b6a1003cc0aa9eae38647452c6c2f4e14e7af724b50496a76d29a8f2a3a73834a7a9f2c081abe36e36614eaa2da9e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4fc28e10136b4099ffeb2e0fe682eb5f

    SHA1

    82de76581b1f5e4d3e527a364dab9a77714ad814

    SHA256

    52ce1f1e5da02529650d66aa6262ad2759c644be67a10434288720cbd2653e75

    SHA512

    fd81e29d694f758659ce53954e33a6cb0eacb632585e3cc9b3c2d599929e5f3125b1c70be5b3f0a93e6f2aab2bd1151e33f81a08d6bfc3209b5cd182e76310a5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    ffe783a8174b2060f68ac2a169985fe0

    SHA1

    c5e5ccb9a2aba62678d9ecd275149f7919c11527

    SHA256

    1e769a309b7ef3b2f144ed61edea9d1668596f47256130e2ee7855172ec20d65

    SHA512

    5ee10b6e44a648a800b398ea2fbbaa9e7e9d4f9c1f6ab6f6f4de20937056501f08214a3814405e18a0a3ed303b57647bca132589ff3cc0b266e9e1e580e074aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4dd316ccf7302c7ec6e71718105f282f

    SHA1

    28295fca6f80b5246b84072486a411c85144cfe1

    SHA256

    53451741cd9614fcc00dbd88398a5a1f98a8ad5b4cbb31632739a470a3ea0f5e

    SHA512

    dfb97dbe5ed9ab9e5e05e486b5c2599326cfe4943323ea17a940666396fcd9472d9d5b566c9881b9e0871008ad96201bf059161e4cd981cdfd462f4ecc15200f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    b7f0d8f8bbd4b25cb31707386ed7b757

    SHA1

    bbe6ff4c0c7d8d760acf5016c574b420fadc3eec

    SHA256

    2b479b3b8a7d8467a1a5bc90dedb1c84f9a9845e92b49c2a8aff41ac5eadaf0a

    SHA512

    434613bfee4f087fd153fd0eb7250497a77a4c1a9a701a8faac02dbd3fa5cd6ab6eeeaa547aea48ce8f9ec351ddbaa53fd55b0fe3de1c434620f8c1c339d793a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab5209.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar52EB.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\SkinH_EL.dll
    Filesize

    86KB

    MD5

    147127382e001f495d1842ee7a9e7912

    SHA1

    92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

    SHA256

    edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

    SHA512

    97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

    Download Submit

  • memory/2160-6-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

    Download

  • memory/2160-5-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

    Download