Malware Analysis Report

2025-08-11 01:48

Sample ID 241005-yc4hxavgqe
Target 2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid
SHA256 95e6f849fe369be53e0493ba6f6c97534f63d0fe74f335fdec303a80ed368c5b
Tags
discovery persistence ransomware
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

95e6f849fe369be53e0493ba6f6c97534f63d0fe74f335fdec303a80ed368c5b

Threat Level: Likely malicious

The file 2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence ransomware

Drops file in Drivers directory

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Modifies Control Panel

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-05 19:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-05 19:39

Reported

2024-10-05 19:41

Platform

win7-20240708-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpenc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Defender\MSASCui.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe"

Network

N/A

Files

C:\Program Files\7-Zip\Uninstall.exe

MD5 8b56d1f57e426cb3718fc4c0d1b5c38e
SHA1 aca76702c2f05c58ae69bf6365afa3461a50ead8
SHA256 2d2dfb7b175459707b6d09d79b47c466b0a71e9763d6c3303a1e3849aa06ea07
SHA512 c5d0f1a07e21d9839646356a926a93f2de87fced493d7e41303e0268be85f7c54ed541683ab7d365762089ea0df35f3f53afe5643df40bb43cdf56d889b4d8e5

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-05 19:39

Reported

2024-10-05 19:41

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp" C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\Desktop\TileWallpaper = "2" C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-05_dde8b8988db2d24f9d0332028432a1e6_hijackloader_icedid.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 69.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Uninstall.exe

MD5 8b56d1f57e426cb3718fc4c0d1b5c38e
SHA1 aca76702c2f05c58ae69bf6365afa3461a50ead8
SHA256 2d2dfb7b175459707b6d09d79b47c466b0a71e9763d6c3303a1e3849aa06ea07
SHA512 c5d0f1a07e21d9839646356a926a93f2de87fced493d7e41303e0268be85f7c54ed541683ab7d365762089ea0df35f3f53afe5643df40bb43cdf56d889b4d8e5