Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 00:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe
Resource
win7-20240508-en
General
-
Target
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe
-
Size
407KB
-
MD5
509dc57fe76d6a3a112417f5e3e780d4
-
SHA1
b5df1ba20c52660fda9cf739da399ec2989a3fcb
-
SHA256
081c042f0d27e44f5883e668cff8132d4d9d5c9f656a625af5239845aa036576
-
SHA512
4cb149d8aa68b6e401fcd6265d600c0812ff0aa0bf7e2bf82918e876f06826351dc7b8d1336767c1e60df779b09d2c76d4ce36690845c8d0711f0854d8362253
-
SSDEEP
6144:fy3ogtorZiarKWa8ocO6c3u29JtKMoZ1gOHgS+ahBf78bfj7IHHNGq:3gKVA6c3u29JtKMogSjowHHNGq
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
Processes:
resource yara_rule behavioral2/memory/1596-2-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-6-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-5-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-11-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-9-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-4-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-8-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-7-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-10-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-16-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-17-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-18-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-19-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-20-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-22-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-23-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-24-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-26-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-27-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-28-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-30-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-31-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-34-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-36-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-38-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-40-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-43-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-49-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-52-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-53-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-55-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-57-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-59-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-62-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-61-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-63-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-66-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-68-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1596-69-0x00000000029B0000-0x0000000003A3E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine F:\kwnlc.exe INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 39 IoCs
Processes:
resource yara_rule behavioral2/memory/1596-2-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-6-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-5-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-11-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-9-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-4-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-8-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-7-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-10-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-16-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-17-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-18-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-19-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-20-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-22-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-23-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-24-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-26-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-27-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-28-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-30-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-31-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-34-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-36-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-38-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-40-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-43-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-49-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-52-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-53-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-55-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-57-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-59-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-62-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-61-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-63-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-66-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-68-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX behavioral2/memory/1596-69-0x00000000029B0000-0x0000000003A3E000-memory.dmp UPX -
Disables RegEdit via registry modification 1 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msedge.exepid process 392 msedge.exe -
Processes:
resource yara_rule behavioral2/memory/1596-2-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-6-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-5-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-11-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-9-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-4-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-8-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-7-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-10-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-16-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-17-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-18-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-19-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-20-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-22-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-23-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-24-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-26-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-27-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-28-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-30-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-31-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-34-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-36-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-38-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-40-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-43-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-49-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-52-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-53-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-55-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-57-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-59-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-62-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-61-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-63-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-66-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-68-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx behavioral2/memory/1596-69-0x00000000029B0000-0x0000000003A3E000-memory.dmp upx -
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process File opened (read-only) \??\O: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\T: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\U: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\Y: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\E: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\H: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\K: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\M: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\N: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\P: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\S: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\Z: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\G: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\J: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\W: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\X: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\R: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\V: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\L: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened (read-only) \??\Q: 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process File opened for modification C:\autorun.inf 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification F:\autorun.inf 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Drops file in Program Files directory 12 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Drops file in Windows directory 1 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exepid process 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription pid process Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Token: SeDebugPrivilege 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription pid process target process PID 1596 wrote to memory of 788 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe fontdrvhost.exe PID 1596 wrote to memory of 792 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe fontdrvhost.exe PID 1596 wrote to memory of 332 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe dwm.exe PID 1596 wrote to memory of 2504 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe sihost.exe PID 1596 wrote to memory of 2556 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe svchost.exe PID 1596 wrote to memory of 2832 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe taskhostw.exe PID 1596 wrote to memory of 3164 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Explorer.EXE PID 1596 wrote to memory of 3460 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe svchost.exe PID 1596 wrote to memory of 3696 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe DllHost.exe PID 1596 wrote to memory of 3792 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe StartMenuExperienceHost.exe PID 1596 wrote to memory of 3856 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 3940 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe SearchApp.exe PID 1596 wrote to memory of 3076 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 4452 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 4756 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe TextInputHost.exe PID 1596 wrote to memory of 5044 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 1772 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4572 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 3336 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4280 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4172 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4272 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 2984 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 788 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe fontdrvhost.exe PID 1596 wrote to memory of 792 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe fontdrvhost.exe PID 1596 wrote to memory of 332 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe dwm.exe PID 1596 wrote to memory of 2504 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe sihost.exe PID 1596 wrote to memory of 2556 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe svchost.exe PID 1596 wrote to memory of 2832 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe taskhostw.exe PID 1596 wrote to memory of 3164 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Explorer.EXE PID 1596 wrote to memory of 3460 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe svchost.exe PID 1596 wrote to memory of 3696 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe DllHost.exe PID 1596 wrote to memory of 3792 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe StartMenuExperienceHost.exe PID 1596 wrote to memory of 3856 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 3940 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe SearchApp.exe PID 1596 wrote to memory of 3076 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 4452 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 4756 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe TextInputHost.exe PID 1596 wrote to memory of 1772 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4572 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 3336 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4280 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4172 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4272 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 2984 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 788 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe fontdrvhost.exe PID 1596 wrote to memory of 792 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe fontdrvhost.exe PID 1596 wrote to memory of 332 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe dwm.exe PID 1596 wrote to memory of 2504 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe sihost.exe PID 1596 wrote to memory of 2556 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe svchost.exe PID 1596 wrote to memory of 2832 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe taskhostw.exe PID 1596 wrote to memory of 3164 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe Explorer.EXE PID 1596 wrote to memory of 3460 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe svchost.exe PID 1596 wrote to memory of 3696 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe DllHost.exe PID 1596 wrote to memory of 3792 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe StartMenuExperienceHost.exe PID 1596 wrote to memory of 3856 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 3940 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe SearchApp.exe PID 1596 wrote to memory of 3076 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 4452 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe RuntimeBroker.exe PID 1596 wrote to memory of 4756 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe TextInputHost.exe PID 1596 wrote to memory of 1772 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4572 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 3336 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe PID 1596 wrote to memory of 4280 1596 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe msedge.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:332
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2556
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2832
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_509dc57fe76d6a3a112417f5e3e780d4_icedid.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1596
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3460
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3696
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3856
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3940
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3076
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4452
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:4756
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵PID:1772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x240,0x244,0x248,0x23c,0x2ac,0x7ffbe8ef2e98,0x7ffbe8ef2ea4,0x7ffbe8ef2eb02⤵PID:4572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2232 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:22⤵PID:3336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3256 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:32⤵PID:4280
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:82⤵PID:4172
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5240 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:12⤵PID:4272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5308 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:12⤵PID:2984
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2756 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:82⤵
- Executes dropped EXE
PID:392
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFilesize
3.9MB
MD5faf79a48399d502194e87a5ad1ba7b8e
SHA109cd9d783ac126d33ec37de781beedce9ce6aa51
SHA2563d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
SHA512d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84
-
F:\kwnlc.exeFilesize
100KB
MD54be27783ae66d56421e7f5596ef81991
SHA1eab5e4275575284caa8c1613b0bb4f8af2ca207d
SHA25682bd5f4bc666537b0ce6d720d7e396283c0e4ffe776966a5ccb0d68939e3e6af
SHA5122c61170120a21896febbecada5a5ecb95d2e5f623589ad17d134b8fd54dc2d80d366b06d4dc734c8ef097edbfb80543d0e107f0942c729778c0168415a0435c7
-
memory/1596-26-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-2-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-11-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-28-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-4-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-8-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-7-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-10-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-13-0x0000000003BB0000-0x0000000003BB1000-memory.dmpFilesize
4KB
-
memory/1596-12-0x0000000003BA0000-0x0000000003BA2000-memory.dmpFilesize
8KB
-
memory/1596-14-0x0000000003BA0000-0x0000000003BA2000-memory.dmpFilesize
8KB
-
memory/1596-15-0x0000000003BA0000-0x0000000003BA2000-memory.dmpFilesize
8KB
-
memory/1596-16-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-17-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-18-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-19-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-20-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-31-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-23-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-24-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-0-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1596-27-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-9-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-5-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-22-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-34-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-36-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-38-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-40-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-43-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-49-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-52-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-53-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-55-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-57-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-59-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-62-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-61-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-63-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-66-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-68-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-69-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-6-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-30-0x00000000029B0000-0x0000000003A3E000-memory.dmpFilesize
16.6MB
-
memory/1596-79-0x0000000003BA0000-0x0000000003BA2000-memory.dmpFilesize
8KB