Malware Analysis Report

2025-08-11 01:48

Sample ID 241005-x7st8azfnp
Target 2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid
SHA256 29e0e1d909aaa3561b5a4d1eaa8b41d5d11a08d3003178ad9d48ef708888b03c
Tags
discovery persistence ransomware
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

29e0e1d909aaa3561b5a4d1eaa8b41d5d11a08d3003178ad9d48ef708888b03c

Threat Level: Likely malicious

The file 2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence ransomware

Drops file in Drivers directory

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Modifies Control Panel

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:30

Reported

2024-10-05 19:32

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Defender\MSASCui.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpenc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Journal\Journal.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe"

Network

N/A

Files

C:\Program Files\7-Zip\Uninstall.exe

MD5 ae914491a07be4b567092ec75b67b43d
SHA1 638a50df3ddf3611a4720ca3793987d5a89e5963
SHA256 c9b1165bb0a6966009dfbfb6a9e1e55b5be79397bcec48b71ad4c387d5080a33
SHA512 594238d45e53f01ca8742aeeb35ba236fbfa108ec6b9eae0c30d3182dc2a91ad7e11768e2f957a6f8487c4dbe705c5f56b022eb2e9d0b8da01cd36050343c6a6

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:30

Reported

2024-10-05 19:32

Platform

win10v2004-20240802-en

Max time kernel

90s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp" C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\Desktop\TileWallpaper = "2" C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_6086859dac39dcbff38f519cd0109068_hijackloader_icedid.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Uninstall.exe

MD5 ae914491a07be4b567092ec75b67b43d
SHA1 638a50df3ddf3611a4720ca3793987d5a89e5963
SHA256 c9b1165bb0a6966009dfbfb6a9e1e55b5be79397bcec48b71ad4c387d5080a33
SHA512 594238d45e53f01ca8742aeeb35ba236fbfa108ec6b9eae0c30d3182dc2a91ad7e11768e2f957a6f8487c4dbe705c5f56b022eb2e9d0b8da01cd36050343c6a6