Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/05/2024, 20:27

General

  • Target

    2024-05-15_876eae7a13756dfb6df30099bf9569dc_icedid.exe

  • Size

    10.2MB

  • MD5

    876eae7a13756dfb6df30099bf9569dc

  • SHA1

    cd7fb896bb30a2f77246fcb060121aacb65528da

  • SHA256

    0b17037c872ad338e70bdec5593ef2d0af673bd8b1cac17adb51dc996a4083cc

  • SHA512

    0ba53fb6ff2984d1ebb498da58f124d42b20aa6153412cbed8d20f1ed47f64dd1a7c20455f146a0275e14c1ef6da008b0ad993825a2b65c7e1421139564c201c

  • SSDEEP

    98304:Xe5x6c1OwoCSG8kM8LNhS9Yw8OCe5x6c1OwoCSG8kM8LNhS9Yw8OV:wKCSL8RwzJKCSL8RwzV

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-15_876eae7a13756dfb6df30099bf9569dc_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-15_876eae7a13756dfb6df30099bf9569dc_icedid.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\Uninstall.exe

    Filesize

    10.2MB

    MD5

    c449b0abc9932cc5809c4f5e303a0cf9

    SHA1

    908bbcb102d80d54fb415c2ba7d192c07e94824a

    SHA256

    af80a1be03216f132d82bcedd0e0843be518e76a3bb6963beadce32114fe5f43

    SHA512

    69d41ad490abd653cc4bd99e5c73f9b668dbd101a7409a6b7f95be6aa46cf8c9fd4747c27c67adb1f172bc0a36c5e5abb7cf4cd7d327b8b4fca2ac571e01e9b8