Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

2024-04-22...id.exe

windows7-x64

7

2024-04-22...id.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/04/2024, 14:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-04-22_733b80290149d1e017edefa22ff9cba9_icedid.exe

  • Size

    584KB

  • MD5

    733b80290149d1e017edefa22ff9cba9

  • SHA1

    ad4ea4995c7578d7994eabc8f733b32f31b4513e

  • SHA256

    7ad46685c9ad2ca65e263e9188b872183799570f9f0ba0ef192310fce5952e57

  • SHA512

    d48e6e209e44ca3455fb6efa0be6da5641b0a1a0fe60bef59407ec10368edb7dcee8c1275e173c448ee4b04c9cd3685c910a36d04dab1e5306ba1f2bb2bd9ea9

  • SSDEEP

    12288:VplrVbDdQaqdS/RfraFE/H8uB2Wm0SXsNr5FU:HxR1+FCcuvm0as

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-22_733b80290149d1e017edefa22ff9cba9_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-22_733b80290149d1e017edefa22ff9cba9_icedid.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Program Files\supports\languages.exe
      "C:\Program Files\supports\languages.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4924

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\supports\languages.exe
    Filesize

    584KB

    MD5

    d8446ed25da948c171174385484612de

    SHA1

    76d8aa1cf924f87a35d49f25a6dd080507214f34

    SHA256

    efd1e2f413340a6917bcc59180d30e7a3e130aea5ca89528985f5cc6f6b96a8d

    SHA512

    36435c036d9e9f7bc647a3b1941e43dc0fb76d2f9c6fb894b0e7145412db754f5d71d9eab334af54c3b664dafb072993bca671ec997b4e284e0320075306f237

    Download Submit

  • memory/2552-0-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2552-5-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4924-6-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4924-7-0x0000000000400000-0x000000000059F000-memory.dmp

    Filesize

    1.6MB

    Download