Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 14:36
General
-
Target
2024-10-09_c81e43e84871227fb10cc8eec978a525_backswap_icedid.exe
-
Size
2.6MB
-
MD5
c81e43e84871227fb10cc8eec978a525
-
SHA1
867d61b8702000b2a72f6c7934442c0ba9413d1d
-
SHA256
7b0663bc5acb6f3ae3f8820a9aab3a5e0650772e9f47c12ee1e8d2467defddec
-
SHA512
6d14f89e17e3dcb82aa313df048065aaa0923256a45c03f8c7f31b31701c08fa0d72a1d0bc81393fe1244861b646689a7219d7a7e71dc266ec3f99b1b9fbdbc4
-
SSDEEP
24576:5nWYXDaHMv6CorjqnyPQGzh0JONZejOuC+e4mOzrvxiI3ENyesg/jHLxQVIxX6La:tl1vqjdPQRw/D4mizA0dizLrB51vT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NTFS ADS 3 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-09_c81e43e84871227fb10cc8eec978a525_backswap_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-09_c81e43e84871227fb10cc8eec978a525_backswap_icedid.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"C:\Program Files\64Âë¸ßÇåÍøÂçµçÊÓv2.4.2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\WINDOWS\Media\ActiveX.ocx /s2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642KB
MD5d871f2c4088b8b4044a06352378e5f47
SHA11ac52a4fa15aaee20307c475ff0ef95351418074
SHA256bfc4f31183a35555e19d2095a743129b20949acbcb5ea43a5fbfaa0b7e624bfa
SHA512294a0cc0d8f89b077821ed97891dc693bdb6dd3f7b4436840f78e5663ece817cf6400d782f31ae33b8fdbbffa9c1691e2411fc9240d2100c2c1e2a4be71b2d68
-
Filesize
12B
MD5f4ec03d2f7ac943cf14ab020a7676626
SHA131b7b0e68fef3b293fed4bcc9db803dcc9d48e1c
SHA2569e3085cb266d1aaf413c2e3f49d80b8bdc75aec68e8620c0922c533ff9b6158c
SHA512517f63a914d6be07c187b73d7bfae689b25ea19977e35260a941af1d26116d7d3e955ef1b9cbf05e61da7e17fdbea8c82a5f7387940e88f4d4c3fe906334d875