Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/09/2024, 01:22
General
-
Target
2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe
-
Size
43.7MB
-
MD5
e8c28242f32cec0687c851aa8166f561
-
SHA1
411c254cb16d4a576bce1cfab2d25cc644789cce
-
SHA256
b81666b56f42d83df228b537a3d4ded8ccad3f066a9dd37aeb759d0da1455184
-
SHA512
bdc902e8e7d86364de24daadd0b3f271c58c22df7d4d8a71ef06c6163d03475e501eb5bc2da5765fe6cffd61602598209c3f840248573b79ba694711d85fdc22
-
SSDEEP
98304:YWoyJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJM:loz
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_e8c28242f32cec0687c851aa8166f561_icedid.exe2⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\1614.vbs"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\fdlaunchersa.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500B
MD5706fa220acb0f46ce34bdc8b9f98bd4a
SHA1e827257ed820d5cda8994fdba8eba76ed02e2b42
SHA256c67c22a9c2b53d439a8cb8d20ff97b75b56102bd3e8d0f7dad281be9b12d0175
SHA5127b8f1f3f2892ae340e5920e34624abb7e48887cdcba9686058324c033bcdf3cacd0b9547ae401d68398f08df752036ffae1966a3396a074da2c71dea161348ae
-
Filesize
43.7MB
MD5e8c28242f32cec0687c851aa8166f561
SHA1411c254cb16d4a576bce1cfab2d25cc644789cce
SHA256b81666b56f42d83df228b537a3d4ded8ccad3f066a9dd37aeb759d0da1455184
SHA512bdc902e8e7d86364de24daadd0b3f271c58c22df7d4d8a71ef06c6163d03475e501eb5bc2da5765fe6cffd61602598209c3f840248573b79ba694711d85fdc22
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
804KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB