Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe
-
Size
273KB
-
MD5
85950244cfa3bf5eaeae6a8ac9022702
-
SHA1
c0445b505dd1d7a1b57065b388480f0628744147
-
SHA256
5a9a945dc592d9a386e89663c42b1660b0b7e6572c3aa44f65c92b4c875673b8
-
SHA512
518d414507e26875508c2f260577688e537d77b86ff531b4b60565836d0a122c5a26115395248159a053df1f0d8eedd98fceabe049cda9901900213e3375e36f
-
SSDEEP
3072:lxUm75Fku3eKeJk21ZSJReOqlz+mErj+HyHnNVIPL/+ybbiGF+1u46Q7q303lU8O:fU8DkpP1oJ1qlzUWUNVIT/bbbIW09R
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2248 license.exe -
Loads dropped DLL 2 IoCs
pid Process 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Redist\license.exe 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe File opened for modification C:\Program Files\Redist\license.exe 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 2248 license.exe 2248 license.exe 2248 license.exe 2248 license.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2248 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 28 PID 2188 wrote to memory of 2248 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 28 PID 2188 wrote to memory of 2248 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 28 PID 2188 wrote to memory of 2248 2188 2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_85950244cfa3bf5eaeae6a8ac9022702_icedid.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files\Redist\license.exe"C:\Program Files\Redist\license.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD59e118c830310b481fa27b52a1500e524
SHA1ede83c81e83f7f9b6130806bbd20a65d235bcb64
SHA256cfb447015ec388fb126cd498f60bcef111d84bd1667c842c16419d64c07e46ff
SHA5126eaa151d79b06d7101d9f274e91c4ff5b94297c04423288f5ff69034258e3aded39b1d143637d8d746c86328dcab57ade2c20d2e23f1dac6aa7e601a1be344aa