Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    22-04-2024 08:17

General

  • Target

    2024-04-22_b6f59201751b3a73de4139c0fe055500_icedid.exe

  • Size

    3.9MB

  • MD5

    b6f59201751b3a73de4139c0fe055500

  • SHA1

    f0c346edf4a2e51bb39be2d57edec66bc68fce6f

  • SHA256

    9af5db571671ea199129a8fdc6cb51217e7656b776be9f60402ef01085e289bb

  • SHA512

    74266bf6840984a3cc3f0384c19048fc16a716ea27141f1d0c955778825122e4617842e656d117edee666a4c6362f7bde0cd7662971cee8c8e205220606297ec

  • SSDEEP

    49152:ZEXGeBsHHSdorG9xgX3oICanZCWKiM1nOn6ckEo3D0PPoe9D1sf8g:ZEWmWrGsX3oxQZjM1nOnS3D0PAaY8g

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 24 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-22_b6f59201751b3a73de4139c0fe055500_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-22_b6f59201751b3a73de4139c0fe055500_icedid.exe"
    1⤵
    • Installs/modifies Browser Helper Object
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1600

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads