Overview

overview

8

Static

static

3

2024-05-25...id.exe

windows7-x64

8

2024-05-25...id.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    141s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 21:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-25_fa5050b7d09810794e7c7cac3b4b0507_icedid.exe

  • Size

    18.0MB

  • MD5

    fa5050b7d09810794e7c7cac3b4b0507

  • SHA1

    0d62687b60f7a7bcd4db682dc3d12a20b4986eef

  • SHA256

    593735831d80284ca008dc667fbc61915eb0001b3a771672262198202ed14ead

  • SHA512

    1f06b370b34135cdc10505b06de4d85c9c4619a312447ca2411a66a5b7427ad4ec9991ef7c570c5e5b5a1bcb9d6aa4cbfc6390ebe10ec8ca26211aefee0e239f

  • SSDEEP

    196608:wlSOAYx4slSOAYx4f8lSOAYx4slSOAYx4fzj:aLVLBLVL2

Score
8/10
persistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Modifies Control Panel 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_fa5050b7d09810794e7c7cac3b4b0507_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_fa5050b7d09810794e7c7cac3b4b0507_icedid.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4496
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:3340

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\7-Zip\Uninstall.exe
      Filesize

      18.0MB

      MD5

      967810383a1a6859fa123acb648b7454

      SHA1

      689c2102c3dfe92d229ed37c64d123ddd918a13d

      SHA256

      d1c88a87b3caa626f6c296a96e3f70450b832b0fa08c7b1ead2f9288d1e3785a

      SHA512

      5ca8e6877f5fc2383b866e4f6844e53eb1bcee70a74b42ed5123ea02c80e5e87e80d0f50cdb7357d2543c50da646e229e6e8685a1f1f6ac93af6e84879616b9d

      Download Submit