Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2024-10-14_ca71e91aecaf5402415f17cce013ead2_hacktools_icedid_mimikatz

  • Size

    8.9MB

  • Sample

    241014-zcl5asygqr

  • MD5

    ca71e91aecaf5402415f17cce013ead2

  • SHA1

    0466fa3668f1b2562669544c40e6b6a261d9fc0b

  • SHA256

    1d7c7cff32440e717013dd7057704a40bf807f8430565d52b52da048655ff070

  • SHA512

    ea18968f6bdd9c26bb9ced1977333cdf042e222f4d883da333c02fc46ef20d7395737c204eb7ba3358d02761667bf3366e8ba396842f60496b69cd1456087f2c

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Malware Config

Targets

    • Target

      2024-10-14_ca71e91aecaf5402415f17cce013ead2_hacktools_icedid_mimikatz

    • Size

      8.9MB

    • MD5

      ca71e91aecaf5402415f17cce013ead2

    • SHA1

      0466fa3668f1b2562669544c40e6b6a261d9fc0b

    • SHA256

      1d7c7cff32440e717013dd7057704a40bf807f8430565d52b52da048655ff070

    • SHA512

      ea18968f6bdd9c26bb9ced1977333cdf042e222f4d883da333c02fc46ef20d7395737c204eb7ba3358d02761667bf3366e8ba396842f60496b69cd1456087f2c

    • SSDEEP

      196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

    • Disables service(s)

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Contacts a large (21051) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • OS Credential Dumping: LSASS Memory

      Malicious access to Credentials History.

    • XMRig Miner payload

    • mimikatz is an open source tool to dump credentials on Windows

    • Drops file in Drivers directory

    • Event Triggered Execution: Image File Execution Options Injection

    • Modifies Windows Firewall

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Creates a Windows Service

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.