1a9f99be6ea38d09047da97d68350d5c04f59cd40269569271ff3231fbabb32d | Triage

Analysis

max time kernel
150s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07-06-2024 06:00

Sharing

Report Analysis Logs

General

Target

icetea.exe
Size

629KB
MD5

ec75749551b255093e77a5d6c1d72e1b
SHA1

fac81f6c1f1bd668b66f2d1d84c6fe2a4e6b0c98
SHA256

1a9f99be6ea38d09047da97d68350d5c04f59cd40269569271ff3231fbabb32d
SHA512

2db7db3fe569d70e476d05f8b4e88e2f5d22ecccce12dca745208001078d0cd9c7f00711b32c2599d2b594f98a6a6ff20ef9c133d3c133654782788f8e5198e8
SSDEEP

12288:sLzn/Pp+rhlRXD4OAo+e9ipG+60o18wnqQ:sHn/PpwhLT4OAFyiEd18wnq

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1088	icetea.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	icetea.exe
Token: SeSecurityPrivilege	1088	icetea.exe
Token: SeDebugPrivilege	1088	icetea.exe
Token: SeSecurityPrivilege	1088	icetea.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	icetea.exe

C:\Users\Admin\AppData\Local\Temp\icetea.exe
"C:\Users\Admin\AppData\Local\Temp\icetea.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads