Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25-06-2024 00:47
General
-
Target
Icaros_v3.3.2.exe
-
Size
12.0MB
-
MD5
9e57c5961a540651d6e6148276f9e086
-
SHA1
fc485e7aa04c4c12b9b936a3dd514de8b7fc3fbc
-
SHA256
3b2a3bbc868a2196f2c990c70889e68e626db5b3ed5570dc949b07adaa3f3084
-
SHA512
18bb77352d820fb1b7e4699f85750adb3f5ed34bd04f1b59081e2d5ea0f36c645cbf89eb79307fd824f6c4a21afab11459c8c07a85f81f303c58fa3fb1d4ca28
-
SSDEEP
196608:gcbIOOxJ6InLDjJmJByfgL56SovUeAnNwvgUQZpBAhFirwt:zOQJB6gLYtV8WgjpBA0wt
Malware Config
Signatures
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 50 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Icaros_v3.3.2.exe"C:\Users\Admin\AppData\Local\Temp\Icaros_v3.3.2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6AEUS.tmp\Icaros_v3.3.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-6AEUS.tmp\Icaros_v3.3.2.tmp" /SL5="$100048,11657425,1148928,C:\Users\Admin\AppData\Local\Temp\Icaros_v3.3.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Icaros\IcarosConfig.exe"C:\Program Files\Icaros\IcarosConfig.exe" -andopen3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files\Icaros\32-bit\IcarosPropertyHandler.dll"4⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s /u "C:\Program Files\Icaros\32-bit\IcarosPropertyHandler.dll"4⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files\Icaros\32-bit\IcarosThumbnailProvider.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Program Files\Icaros\IcarosConfig.exe"C:\Program Files\Icaros\IcarosConfig.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe" /s "C:\Program Files\Icaros\32-bit\IcarosPropertyHandler.dll"2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
298KB
MD56fd2e8e70ff2b1d847f7365445231f6f
SHA1b3db8581661f52d83c224e8a8aa36df609bc04eb
SHA256d2e7d41ac263d0505b1c5fb0b7dd14c8d6591a27ab7cc75e064769bbb829cdbc
SHA5120f01de6cbfdb773e63e9d144fd9cb734309fdccf3e0fff0c78204dcc1a6ee7157fa1c71c200a42819a5e1f5b14cbb49edc6c59a6a876fe00922d967efbb453a6
-
Filesize
738KB
MD549a47c49d2d180e0895ed8348a4e599a
SHA18f8ffae12b9c6b7e67505bff35e583973e2e171c
SHA2562ea7e84d8879204fca783bb695deff13c077dd2dd225dc0810eca2b19023cc53
SHA51286a746b01379e13b2f5c6008f5b4199d039e5ab5f9358733e87bf89baf743289dfba0f111d211aec3b930bf215ca7a928b1e8c16e38621cce2eafebf611cf594
-
Filesize
311KB
MD50cbee6b4e72eec7997c738bcba76a6c2
SHA131824e5f6ab2ea2ae00a3a06086f03e3a76594e0
SHA256e8da8cecadc896cb3290c717bc1423ac4102a31ea0ffec01b42afe9e098fb421
SHA5129e5677ebb573850b6ef0d851824f5a7e5db3d12d7c9bc9a170f1f456d22d51bc09d1edef7ed239c65d59da152733fd0da27a8ca4a958e6d767307e28fd2721d6
-
Filesize
9.8MB
MD5274056132037e78378119d5d9e976c2b
SHA10e8fd66504a6003f65d1954dcfc962cec422c132
SHA256c96df69cfefcce6757cf20b7c2b4be1ee39a6092db1650c1f22f1dd3110011bf
SHA5125521dc110de3fd8e4fca6e3101d362e521c1caa01005561be8b2a8277647b3c8fc30b90a9a33c2310fb60738c573349f7764ff95db8093cc3f428f0f682d21fe
-
Filesize
1.5MB
MD5a3e300e49716be88abc64ac71f0f04cd
SHA14a7d07731caccf6c2577f6ba1be55c1d616dfe27
SHA25692f76476f58c86a7f22841a01048ab6e4b4bc3a9b14a90d71c2b673dbeaa8ad3
SHA5125b15a181c487729c83d7afbbdfab464f17378015ca85995b78e6c47f7023388b2245ffe25670975eb3919094b5dc539eec64426a44748e75fa536f7666fb59d3
-
Filesize
865KB
MD5457fe0b84ad4a8a04e528bdce529d22a
SHA1a4ca474906d0df46a1d16c650d6c6088eaa290da
SHA2568ba430a64d33b96aeba046e439a874f28320a554ae68d9cd5af2edc1a5cff182
SHA51252390d48f4ea8e78c5eaa018ed60aeae5cd2b78cf7fcfe22559058e3a56564eae8c77129f47bcdce7409fb3e2fbdb45db1cbbc106e868f23a9475a646f0ee21d
-
Filesize
329KB
MD5f305baaaffd9f69034c0563b7e192b1b
SHA18dbae575d29f1050371ef356621bb25bba10dfc2
SHA2569baf0cb8ac693d8c269286d596e410bed0242aa0d8d5a9797bae7949526d76eb
SHA512582264c743207b708a75c8e5f3d07362dbea41aef5fcaf28da897e383e3fcae47545657d53285d53bcaa5eaedbbe0e8e1bae1e86e83ea6016a4f15e741d78d40
-
Filesize
497KB
MD545965d5ffd01891ccf7a84866461c3e7
SHA10fc6ad0939972c2a77b359cc551d86d535933ff9
SHA256957021ab7da63f80ff8fd4086bc38db43e2b01fa9423d672e0807fa4586045a7
SHA5128f30817e5a7b24b78370dd5e84528e684eee8f0deb2ae05c42a378fc0d8b66b36c4f3402b9e16c3beda42314bf0b580e248ccc90afdec0eb03870cc9faadabb1
-
Filesize
368KB
MD5a6dde6e328aa446b3d98d8687ffcacb5
SHA1aa34feef9e83033cd1bcbcc53cba91bc01e22281
SHA2567426f66a80dc9f5a55315fd93db6c1bb096005272b99e2759bbeb1a6ce860f13
SHA512ef1ece69ba22e49dd5b74bbb5cbbb148c6b18737642d534b8664c98cbb58a08a45a6a7431257d6682e0d4126100e473ac0372f6bcfbd4a889c621edb9901368a
-
Filesize
885KB
MD5f557bb97bda5c359be1edf8b355ff5f8
SHA13f3a88dd92dc0619360df62a1d55279ea62c8355
SHA2564810f483b41e444d971f8c2e652ba766febf7cd559223c81ad60dc62a3ad51e2
SHA5129d68af5f3d3d7702dfa5e386adf4dfb3ab70d830094f9426183363b5bc5be4dff82ea3808ced8ab4e88360a8226ac9a6b5a789a99156272e08bea22e4d202454
-
Filesize
386KB
MD51d984ec246d39babf30b32b32747f56f
SHA1bb1ecc95867a4dd25cfdaf06d3232b81d7b1d8cb
SHA256a431b8e8a5138f66c782babfacaca4951eba09c3ab6e1c399089e485e9c9ed3a
SHA512e7753b189f7ab4a2bc4ef69326c54ae38f4250166446b0501fc6772f6ed582bcbc13cc998dfb5b7af1cdd050440e344f9111a07ca3d4b5376f6dce1256bacb1e
-
Filesize
10.8MB
MD5f11e8cebf672d70bf308cab7a61bf6be
SHA17425d7b3b4b5bd224c9bcb562c60f1b2a61c0339
SHA256c39cf55cbb3ea137a62e3713ce9ff09fe5ef65285337f1f9196b38ad34248a5b
SHA5126677d9cc08129939319d7c90770a089e6ee829790c2bdc72adf5033bbf5d5297a8a00a90ed6c0a330b18b79e58309876998d8e6e2bbab2a95a22cef706eecd95
-
Filesize
1.3MB
MD5a871b58a99a933a9322980ff704410d6
SHA1ed117472979ef50b255955956cb481602ceebd0e
SHA256776d889f997f257c41081911505d6344d17277c2c0f51a8b68da10c031d4c44b
SHA5127a202e3dbe2d56a13663d79fe440a349d9d32ffb6bbfe3e36054d664e12e33cc557a02fdc7581b20a0d4b61750350911f4a960d22fdbd53ec6db2412c7a742a2
-
Filesize
976KB
MD5a7373622fec1083a03a62419964c9b95
SHA14083313abc3c0b550f9d2025d55e37858243bbc4
SHA2565b651beda71ceabad6ef79252455ae0024f2e48c3963115cc213984672f2ff45
SHA51215ffffde7d6a7e974b13bab655c7e500c8fadc36f04dcc6c8f84585ceb5e39e0f1f2e08fa6e96cc9478df11ebd6e0c0057707a2880299f3645e30d037752dc54
-
Filesize
380KB
MD5fdc83ef9f9e8985f654f7900d25466f5
SHA17e86288fc779dad4710c639b68be78318bc66168
SHA256a2d6805d3abcd73654f89ada0f3bd04193d8270832aecae2bfe5d3fde9ea5bba
SHA512cae4cea646638fcf8b6a6b69c1ffab5a5ec04a5f8f20b843160b9258d0a3c0730050920bb8bd7fee91e1d8d67b2c79c4295edd8fe0c9eeb76b98d61dd98bf510
-
Filesize
601KB
MD5694c1db1928d363733dafab180dda362
SHA1422995f64ed27fbc0f95aa1a448be4b5b12525e2
SHA256b1002b4ebff4991135e1236412d8ac97247a241ea20a81e869a48f60d5ec4b3d
SHA5121a7a9117a366e96e760ec2c7398604875075f7ded4a4049310134042b2e7f70735ad4fe7a7e50d87d9769e42849722878fcd4bbe6add8ddc82c3a5990b1c19d6
-
Filesize
339KB
MD56cd0af176a4e1aa7446e742e3db62f60
SHA106f081540349d2863a7730cf83fb4d5a2fdc0b36
SHA256e8076332aa96f7da4481f4e8b053f607fa96ebd79bbb91ecef062bc07b2733a9
SHA51257232cfc62b05ca797228907ad706640007992da83ad1cf39b79f2a99ece521d73c0cf8803b73ca3029c1b63a5da192590f86d56cdd3ef67fc8a9ec4c5397654
-
Filesize
384KB
MD54cd0fb9658aa390f21f755a3e76b7c7f
SHA18fd56558b0e9a21342838d8d63facac3f3e8094c
SHA2566751a3f0c94b199addd8a555f19bd11c2320d161a4fbf773276cd5d25dfb8617
SHA5128d4d03f25f4908d5746afd288f286d9f23c189604e1438331de10d3242547ea78b64d180652a651fd5632d6ca6722aeeaa89c560c6ebf517aecf99375f50a3d3
-
Filesize
3KB
MD5f75fdf4a6bb16856dd986955fc48045e
SHA175dede53e486a49cbbbeac9425a8ddbce66b8095
SHA2563ee452eef41171c7b775abfc8225f11d487c40c272938f9e307ed505d8e29244
SHA512beb154a312f8537c5c218832a9a73ab287c242a80ab3911b096dd27758b194324772cae1996e7bb75374ac6d25361e30d579ff4d96c5170c2aa7cbe91c2c2594
-
Filesize
2KB
MD5a71cf0514c0d79409ed3642d62e5aecc
SHA157a0465810238a1c3404f8209b76449821766cbf
SHA2562c123183718bcb94c4104dc9a8bbf01b184ec583168d713721de5c4c83a8586a
SHA512269256acf21f2158d4a99f4893b79f0caf5f9ef156a065141ee02c9ad13b8f71ddac0d6acbe5766b2a7c4d79f83497f2c05d0fb7b7c7866e738a9b0a0e3e4a33
-
Filesize
3.3MB
MD5ea2ddff78bc9a16d4cf2c9d4684853d6
SHA1c52e26f1c07e89d957b812be518c173b75444a9d
SHA2567dd93f3f0604ddf9647c1a0395de84045e1c573fcd5594340bc8973f002c84bb
SHA512795c949f62192e10a94389559572c1d33dbbb36c835629d3217ead0518a5ec05fd0120bccc0ff48f14dbce74aacbc87f649f2e7b6c568a2991fc616ca3aa1f1b
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
728KB
-
Filesize
408KB
-
Filesize
360KB
-
Filesize
1.4MB
-
Filesize
17.1MB
-
Filesize
408KB
-
Filesize
13.6MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
668KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
1.4MB
-
Filesize
408KB
-
Filesize
668KB
-
Filesize
13.6MB
-
Filesize
17.1MB