Malware Analysis Report

2025-03-15 08:13

Sample ID 241016-jpzcdszfld
Target 2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid
SHA256 276e33799900b3e9dadd650f4b24716ad49db3bc630897ea33eb76cb0025e9aa
Tags
discovery persistence ransomware
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

276e33799900b3e9dadd650f4b24716ad49db3bc630897ea33eb76cb0025e9aa

Threat Level: Likely malicious

The file 2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence ransomware

Drops file in Drivers directory

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies Control Panel

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 07:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 07:51

Reported

2024-10-16 07:54

Platform

win7-20241010-en

Max time kernel

20s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmprph.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\WMPSideShowGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.properties.src C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Journal\PDIALOG.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe"

Network

N/A

Files

C:\Program Files\7-Zip\Uninstall.exe

MD5 6c9ab8bfa8556ca42a14e8010aae28fc
SHA1 e5003ba36a2cd2af765f22abe8cd530068bee822
SHA256 599317c6b014c7b936efb7d77d7bc907051dba4e1aaf4fab449e59b0f25559f6
SHA512 a56b5c9ec72485b91f938f96280da7b528d08dbda6b292e52e124e4e69ce5dca74edcfd9a57678d74cbb2868fa13899b7b647c69b12e518cae45eb7b18350466

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 07:51

Reported

2024-10-16 07:53

Platform

win10v2004-20241007-en

Max time kernel

136s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\windows\SysWOW64\drivers\spo0lve.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe" C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp" C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\fontconfig.properties.src C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows NT\Accessories\wordpad.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Windows Media Player\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
File created C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\WallpaperStyle = "2" C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\TileWallpaper = "2" C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_503e1224be5a99aa8267fc58365c75cd_hijackloader_icedid.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Uninstall.exe

MD5 6c9ab8bfa8556ca42a14e8010aae28fc
SHA1 e5003ba36a2cd2af765f22abe8cd530068bee822
SHA256 599317c6b014c7b936efb7d77d7bc907051dba4e1aaf4fab449e59b0f25559f6
SHA512 a56b5c9ec72485b91f938f96280da7b528d08dbda6b292e52e124e4e69ce5dca74edcfd9a57678d74cbb2868fa13899b7b647c69b12e518cae45eb7b18350466