Analysis
-
max time kernel
111s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
icsys.icn.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
icsys.icn.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
icsys.icn.exe
-
Size
135KB
-
MD5
8725f3e210101a5732789764869a2e32
-
SHA1
bd6cea1e863892119a53dbc9e09638ea0dffad21
-
SHA256
ed506815979d039cb13f24ef565a9d8e28d442b01507da413b090cbaffdc73a6
-
SHA512
7d3bf2f0dd6fec46cd2496037ddc60f4b9c4b3a6a795c63bd540c6b70886218296bc8facc2ee8c6c405cc46b6b29eab66843740b5a0e5fdfab000337a671f409
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXB:UVqoCl/YgjxEufVU0TbTyDDalRB
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Executes dropped EXE 4 IoCs
pid Process 1752 explorer.exe 2172 spoolsv.exe 2848 svchost.exe 2732 spoolsv.exe -
Loads dropped DLL 4 IoCs
pid Process 3064 icsys.icn.exe 1752 explorer.exe 2172 spoolsv.exe 2848 svchost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2612 schtasks.exe 1804 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 3064 icsys.icn.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 1752 explorer.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe 1752 explorer.exe 2848 svchost.exe 1752 explorer.exe 2848 svchost.exe 1752 explorer.exe 1752 explorer.exe 2848 svchost.exe 2848 svchost.exe 1752 explorer.exe 2848 svchost.exe 1752 explorer.exe 2848 svchost.exe 1752 explorer.exe 2848 svchost.exe 1752 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 1752 explorer.exe 2848 svchost.exe 1580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe -
Suspicious use of SendNotifyMessage 53 IoCs
pid Process 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe 1580 taskmgr.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3064 icsys.icn.exe 3064 icsys.icn.exe 1752 explorer.exe 1752 explorer.exe 2172 spoolsv.exe 2172 spoolsv.exe 2848 svchost.exe 2848 svchost.exe 2732 spoolsv.exe 2732 spoolsv.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1752 3064 icsys.icn.exe 30 PID 3064 wrote to memory of 1752 3064 icsys.icn.exe 30 PID 3064 wrote to memory of 1752 3064 icsys.icn.exe 30 PID 3064 wrote to memory of 1752 3064 icsys.icn.exe 30 PID 1752 wrote to memory of 2172 1752 explorer.exe 31 PID 1752 wrote to memory of 2172 1752 explorer.exe 31 PID 1752 wrote to memory of 2172 1752 explorer.exe 31 PID 1752 wrote to memory of 2172 1752 explorer.exe 31 PID 2172 wrote to memory of 2848 2172 spoolsv.exe 32 PID 2172 wrote to memory of 2848 2172 spoolsv.exe 32 PID 2172 wrote to memory of 2848 2172 spoolsv.exe 32 PID 2172 wrote to memory of 2848 2172 spoolsv.exe 32 PID 2848 wrote to memory of 2732 2848 svchost.exe 33 PID 2848 wrote to memory of 2732 2848 svchost.exe 33 PID 2848 wrote to memory of 2732 2848 svchost.exe 33 PID 2848 wrote to memory of 2732 2848 svchost.exe 33 PID 1752 wrote to memory of 2808 1752 explorer.exe 34 PID 1752 wrote to memory of 2808 1752 explorer.exe 34 PID 1752 wrote to memory of 2808 1752 explorer.exe 34 PID 1752 wrote to memory of 2808 1752 explorer.exe 34 PID 2848 wrote to memory of 2612 2848 svchost.exe 35 PID 2848 wrote to memory of 2612 2848 svchost.exe 35 PID 2848 wrote to memory of 2612 2848 svchost.exe 35 PID 2848 wrote to memory of 2612 2848 svchost.exe 35 PID 2848 wrote to memory of 1804 2848 svchost.exe 39 PID 2848 wrote to memory of 1804 2848 svchost.exe 39 PID 2848 wrote to memory of 1804 2848 svchost.exe 39 PID 2848 wrote to memory of 1804 2848 svchost.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\icsys.icn.exe"C:\Users\Admin\AppData\Local\Temp\icsys.icn.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:06 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2612
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 07:07 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1804
-
-
-
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe3⤵PID:2808
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1580
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD56b0a09d6ffc57b992a7eb835ceeeeb6f
SHA12858fb0f3cd9042e939f9c5e5cfb9a4da3fe1822
SHA256db89b06011c1790ec3892d0ae30cae4300404f7343e75cbdf7f51471ef4a146d
SHA51280fb450694b1eef4a9bdf949bb020b9fba5fc7588d3f3b1b034837561fa48fa990715769079e8458ae2a87662ca66f3eac3bd75840c471ad56b82c7f6a202289
-
Filesize
135KB
MD51b3676f49897e154d0ee2356c49f3ae3
SHA1f76748b429da501a7b2efe41d8a9ed69a298d637
SHA256b61dc0d32ca231bd4194c9d60d1059bec19a08ba1d080f9118931f9a699632e4
SHA5121866b4c3926850c0b9ef51fce20788ef2d3586363412c339c8b6fe2110b6c8bad8117f12b28201968123edcd549467fa6a1601b1a9aa8b7ac29c4a59cd16ea30
-
Filesize
135KB
MD5debd4e936afabfc220303174de6d189e
SHA13f28d6ffff01ce18a5dd2e65caa7369fd8e35c2d
SHA25630056a4aa26aa76531618f13b5c8814f8ef71176f4de00f79dde03b6c287749d
SHA512e9cf34d57c6d26fca3ac8947c3d8baad4db7fb54e786b339d3f3be706a432b0c6496ad041ea6b1f3be461a8f2daebd14488df77ace7652ba488d9e37ded417be