Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 08:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe
Resource
win7-20240903-en
General
-
Target
2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe
-
Size
944KB
-
MD5
a9fac3c330fa3c2a26d001c6eae5bcc5
-
SHA1
aaf2f651c606f4ccca4423c9fbb820f856088e85
-
SHA256
8cb517b8af09e15a9365baa0626627df072d3a23c0b2e7aa3f275b5da14866c9
-
SHA512
897dab1ffc546327530be4492bb348d9bfbbcca000555b66f60dcdfc622bd1e32e1097a7c89348d43cd9b5274e11c4ef1da632a5c4eb4b98e818bf85b6bb83d5
-
SSDEEP
12288:NdY9T5F1L2J1CfH5HX3S8uhe9P6rKpn1RfJVLYCd+aKR5nWFpPoSbT:NI5HL61aH5HSZc9PqKp/fJxYCQab1T
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2012 set thread context of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 -
resource yara_rule behavioral1/memory/2012-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-33-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-31-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-11-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2012-0-0x0000000010000000-0x000000001003E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2844 svchost.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30 PID 2012 wrote to memory of 2844 2012 2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_a9fac3c330fa3c2a26d001c6eae5bcc5_icedid.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2844
-