Overview

overview

10

Static

static

3

icsys.icn.exe

windows7-x64

10

icsys.icn.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 07:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    icsys.icn.exe

  • Size

    135KB

  • MD5

    8725f3e210101a5732789764869a2e32

  • SHA1

    bd6cea1e863892119a53dbc9e09638ea0dffad21

  • SHA256

    ed506815979d039cb13f24ef565a9d8e28d442b01507da413b090cbaffdc73a6

  • SHA512

    7d3bf2f0dd6fec46cd2496037ddc60f4b9c4b3a6a795c63bd540c6b70886218296bc8facc2ee8c6c405cc46b6b29eab66843740b5a0e5fdfab000337a671f409

  • SSDEEP

    1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXB:UVqoCl/YgjxEufVU0TbTyDDalRB

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\icsys.icn.exe
    "C:\Users\Admin\AppData\Local\Temp\icsys.icn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4700
    • \??\c:\windows\resources\themes\explorer.exe
      c:\windows\resources\themes\explorer.exe
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1124
      • \??\c:\windows\resources\spoolsv.exe
        c:\windows\resources\spoolsv.exe SE
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4012
        • \??\c:\windows\resources\svchost.exe
          c:\windows\resources\svchost.exe
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4276
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe PR
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:8
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3620
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4160

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Resources\Themes\explorer.exe
      Filesize

      135KB

      MD5

      c890dfecf4dc2b63db74cff414e42442

      SHA1

      f09da555dd05c21298a3fd0835c058032a8113f1

      SHA256

      8112c50f040ddc51e3427473807396594bb29b8b4e960ff4dcdc89e0af245143

      SHA512

      5b30a22b54e138b47d785b8034d9488b97b50a82de144de689c560390589e631c093cc66cce1f3877d504642d7a59631c46ac81cd65c7e8cb9d3f98b83f3ba77

      Download Submit

    • C:\Windows\Resources\svchost.exe
      Filesize

      135KB

      MD5

      a7d43aea2d7be76f1a339d653091b023

      SHA1

      5f1bccd2f0b4d1fbda1b5cec6a0a1cdf0834ce44

      SHA256

      0c331159322d9a415e771d8eb8776143b74b0e2f131bc18f5077fa96b903f7bf

      SHA512

      c19caf8e4f2d3676e2532a24c61e2002817b4324055cffe90300da3a45dc7c4069ebb8fd05ded55f945313b8bb345486d5db688fb4df715511501205176e3367

      Download Submit

    • \??\c:\windows\resources\spoolsv.exe
      Filesize

      135KB

      MD5

      d10205751c3ba0327bf948717642104d

      SHA1

      c6521d7f396e66fae47e6c1737b833de2d7ce885

      SHA256

      0199ac520b60a66d791d41ee64104c929fd60aa400ae8cb2bd64dc5ff922210e

      SHA512

      c99a10f3dc8f177f7d0e422261e6d34cfe67bdbe6b58ae4362dd107cf3faf04eb5e30c5d48ff8d4aff66f73d5425256116dbc2f671d3c83af14b628d9005f6da

      Download Submit

    • memory/8-29-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/8-33-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/1124-49-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/4012-34-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/4160-38-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-36-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-37-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-42-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-48-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-47-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-46-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-45-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-43-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4160-44-0x000001FC32130000-0x000001FC32131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4276-50-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/4700-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/4700-35-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download