Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05/06/2024, 03:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe
-
Size
1.5MB
-
MD5
f5b396a67db51fcfe5b4426b8a54a2ad
-
SHA1
3c847f2fe2d24de6c4a8f6c9789f47e9b150acb7
-
SHA256
e133ef4fbf725f29220f1f35c3b8dc6fb05935a9063cdd48627da58b57f0e8e7
-
SHA512
d1d2ff474c4600483bcf4c09875abddd94f59401ea323073a27c8402c8df3e2821e627fe9cca764cae2c2ec3ebe98fd4ca08f89342c2e1413b72b3515415f2bc
-
SSDEEP
24576:+LcFcfUqXkpAoapjLPlULJXldp2+pGTkgNtkLF/Ppv9U59pwuTV/B:+Lcu2Fa2ldpvGTkg0LF/Ppv9UrpwuTlB
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2824 2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2824 2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe 2824 2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-05_f5b396a67db51fcfe5b4426b8a54a2ad_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824