blackmoon | 751667587c73d0982ae5d9bf65bce904e5d25de3969300b3f18e03d5c8534b78

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Size 3.7MB
Sample241017-1tk41ayeqg
SHA256 751667587c73d0982ae5d9bf65bce904e5d25de3969300b3f18e03d5c8534b78
MD5 6ca480efc6bbd9827cfa7d91031d6c8f
SHA1 49e758f1495425a226178c4ad10f1dd2bf5efc57
SHA512 d3ce3c0c25c401a75ee4610ab4f182567e7dac08cfabfe43e22062b5f74fd7a9ae9b78d5eeddc1b3e58f0de9e4c75754eeb8b7868990c04cc70ac0cfff80df33
SSDEEP 98304:ykCuRfMMMMM2MMMMMARfMMMMM2MMMMMR0oAaldmdmnpNmi78gkwo:bKmd0u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker discovery spyware stealer trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00020000000229b0-57.dat	family_blackmoon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Executes dropped EXE 1 IoCs

pid	Process
2692	mail.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\S:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\T:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\Z:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\J:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\L:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\P:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\M:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\N:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\O:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\W:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\A:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\G:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\I:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\V:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\B:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\Q:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\U:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\X:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\Y:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\E:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\H:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened (read-only)	\??\K:	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\odbcconf.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\w32tm.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\wextract.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\autochk.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\choice.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\InfDefaultInstall.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\iscsicli.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\logagent.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\RMActivate_isv.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\cipher.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\ftp.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\sdbinst.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\LaunchTM.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\LaunchWinApp.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\shutdown.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\dtdump.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\msinfo32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\OpenWith.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\whoami.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\msdt.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\net1.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\nslookup.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\poqexec.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\unlodctr.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\fontview.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\gpresult.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\netsh.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\sfc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\svchost.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\systeminfo.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\tcmsetup.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\agentactivationruntimestarter.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\certreq.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\diskperf.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\gpupdate.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\ntprint.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\PkgMgr.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\TapiUnattend.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\wscadminui.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\findstr.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\rasphone.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\Netplwiz.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\rdrleakdiag.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\credwiz.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\dllhost.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\Fondue.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\SecEdit.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\TpmInit.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\appidtel.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\ComputerDefaults.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\forfiles.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\logman.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\MuiUnattend.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\rundll32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\Com\comrepl.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\DevicePairingWizard.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\EhStorAuthn.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\lodctr.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\odbcad32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\rekeywiz.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SysWOW64\sethc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Windows Mail\wab.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files\Windows Media Player\wmpshare.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\notepad.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\b6c0024236e5d701ea9600001815341f.eshell.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\f2329d4736e5d7010ba200001815341f.iissetup.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\d0f48d4536e5d701029b00001815341f.InetMgr.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\Speech\Common\sapisvr.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6_smss.exe_d7209c3a	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015_wowreg32.exe_94fc2d06	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57_svchost.exe_4dd0f0bc	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\ace9914536e5d7010a9b00001815341f.WMSvc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f_sppsvc.exe_fc6922a9	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671_winresume.exe_85cd1215	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde_fontdrvhost.exe_94bdc76d	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3_pacjsworker.exe_6e8eaf33	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe_nissrv.exe_f967cd63	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\WINDOWS\IE2.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\servicing\TrustedInstaller.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3_fontdrvhost.exe_94bdc76d	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334_xblgamesavetask.exe_e6e69c44	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a_wowreg32.exe_94fc2d06	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9ab96313e8d638bb_iscsicli.exe_20e14d4f	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\WINDOWS\IE2.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Windows\Êý¾Ý¿â.ini	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\winhlp32.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\ad40614236e5d701629700001815341f.UwfServicingShell.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_60f873a5caaf6704_winmgmt.exe_8f8eb7b1	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454_memtest.exe_01d80391	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c_svchost.exe_4dd0f0bc	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9064b8c1b47576c0_iscsicli.exe_20e14d4f	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c_tcblaunch.exe_d6a1d462	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\aa9a364536e5d701869a00001815341f.inetinfo.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.844_none_7eaa07ee55c22dcc_winmgmt.exe_8f8eb7b1	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336_dwm.exe_04cf416e	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7_msmpeng.exe_2f1c6923	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.746_none_e5e33ba764e4ddec_bridgeunattend.exe_60b7e340	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e_winlogon.exe_ac37d0c5	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\0be59c4736e5d70107a200001815341f.appcmd.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\write.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d_wininit.exe_7a527f28	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\a30f994536e5d701169b00001815341f.aspnetca.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\b6c0024236e5d701eb9600001815341f.CustomShellHost.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\Boot\PCAT\memtest.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3_csrss.exe_06529458	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4_vds.exe_cb461c29	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File opened for modification	C:\Windows\IE2.EXE	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\PrintDialog\PrintDialog.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\1ea4214236e5d7010e9700001815341f.hvsiproxyapp.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\e374984536e5d701109b00001815341f.iisrstas.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\bfsvc.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\explorer.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7_mpcmdrun.exe_1d1038c2	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c_appidtel.exe_b664fbc5	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da_rasautou.exe_477abe34	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1_appidpolicyconverter.exe_83972af0	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\HelpPane.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\hh.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\splwow64.exe	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
File created	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4_vdsldr.exe_20c491b3	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mail.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
4920	msedge.exe
4920	msedge.exe
592	identity_helper.exe
592	identity_helper.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: 33	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
Token: SeIncBasePriorityPrivilege	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 2692	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe	84
PID 3344 wrote to memory of 2692	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe	84
PID 3344 wrote to memory of 2692	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe	84
PID 3344 wrote to memory of 4920	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe	88
PID 3344 wrote to memory of 4920	3344	2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe	88
PID 4920 wrote to memory of 4860	4920	msedge.exe	89
PID 4920 wrote to memory of 4860	4920	msedge.exe	89
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 3988	4920	msedge.exe	90
PID 4920 wrote to memory of 1000	4920	msedge.exe	91
PID 4920 wrote to memory of 1000	4920	msedge.exe	91
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92
PID 4920 wrote to memory of 2512	4920	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-17_6ca480efc6bbd9827cfa7d91031d6c8f_hijackloader_icedid.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\mail.exe
  "C:\mail.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.dywt.com.cn/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff9869e46f8,0x7ff9869e4708,0x7ff9869e4718
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,5984938226703305228,11039671919882594230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 4.6MB
SHA256 0814553da81a55ab22c8a9d4cb34b11ddd0bac618ae043a70a9ef59c18580c67
MD5 a74d5a656d1723cfd1c28097b0ff1110
SHA1 38b6f223742f5464192277a9fbadda52eb4d8253
SHA512 292e900d11d254dc0d7f01df051576a565fc218980404b8a343e005f192e33b2cd20d6762aa9787177b3aeec13dee20c33e4cdbc2a49c2f2dca2977fcbed00f0
SSDEEP 98304:ykCuRfMMMMM2MMMMMARfMMMMM2MMMMMR0oAaldmdmnpNmi78gkwo8mi78gkwo:bKmd0uJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

544ab7b9-5b3c-4dfe-b457-a030d8793624.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\544ab7b9-5b3c-4dfe-b457-a030d8793624.tmp
Size 11KB
SHA256 2a2f767173e50933b5d71e85fce8ace8b27224f79030d44f6dbca882c91dd657
MD5 6e98e50a635e4222e7330c1acb6891f3
SHA1 4cce5c54877f857cbc6a5770c93ad711cadf76c0
SHA512 877e9016399898d08c98c7d441414063c73fa4f0e6eafde48edda9db63700b74c53a8919cd1a79fb9817647c3f498ef9e52e9a52c9ae96b7dd4e6d17a3c50c2b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUe2RUYLkyoH1K3wUCeu:A9iIxuERzA83h09RZxYax6VKueu
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 07f6bdac95a99ee024da97e19d4c8c669f29ee3662cc70e35db832475556e310
MD5 016ac21a6fda8250fbbf1c285f848ab8
SHA1 5885c152755fc9f09ac837aca6719e23e9ecac52
SHA512 802388d96ee76ec649539fcbf6c1b21a07ff322dbd0bad66d383b3c942277bf1ef70ffb5a238f22703cffce07223269c9f7b3413ae14f5448e9a6d10b5128c1e
SSDEEP 96:nrkEN1A9wpvWMoiVmdeH5ewgUWQyV+VDCziEwb:nrk8e9GWMXngro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 22a8925ce342c9566a6138a4e868971490fd18be5fb705daa283aee5bc09d634
MD5 fda1da709ef931a91b1ed186d5b927fa
SHA1 077c3f7a3ee922dbc3fbc3fad051ccf2a7c427a0
SHA512 1d35779923a0825ac6a2bc5220af3ab8a04ef044d5d292a5c71bbd6f2aa8730d8e7b7e6d71f1ece7d60c29ff5cc11b9b2a0b68011ef9ad429d02ac67a9cff03f
SSDEEP 96:nrkON109wpvWMoiVmdeH5ezgUWQyV+VD7AiEwb:nrkem9GWMXUgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Êý¾Ý¿â.ini

Path C:\Windows\Êý¾Ý¿â.ini
Size 4KB
SHA256 2c66a56cbe6c5666761dc6da3c2a5b05d87782fae405ce0d6217c92ed5c3d9eb
MD5 0144f651d4c4f2ad9a2326e39c92ad81
SHA1 8592554cfc41447b074023a0b5f855f04cc50188
SHA512 b83dc7d60b58ee8b899370c82ed6c265eaabbd7f16e1faa93be0573ed774ff9b365bf2e9ccdfe03ea11a5ce94aa728515589b97e4a9b159e565ff07a76758b6c
SSDEEP 96:Q1+CWSWZWRCWKnWDXqbVNWZxegxxrhrpKP3T/oevrFMC0fleKxQDdCYfIMKO+ROT:HcLKnLXnFf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mail.exe

Path C:\mail.exe
Size 63KB
SHA256 6c04ae545e15fe257e1cfe374649ad968a643ceb7e3f75a834825530633c30b6
MD5 797d36d890bd96ef00369a2f4ee00f07
SHA1 ece843e8e93f8d8dcfa69961898043391e6cef69
SHA512 6064215d00f7bde0a052b5eacd19eb5dd40021d5dc0ead3a816700cb89fdd668445258367c1c24ab9008a53978e84ea0fc0f675582ed5a957bf31cff41c68bb7
SSDEEP 768:m6dN2ieJlbdp9RlTddT1T/MMMMM2MMMMMsOS:m6d9eLbv9R/dT1rMMMMM2MMMMMHS
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcredist2010_x86.log.html

Path C:\vcredist2010_x86.log.html
Size 81KB
SHA256 869fa7eb157c054dbdabd9e09bbc337710c825aa4ede0a4e45e60def2046947c
MD5 ace4f2318ec9620ea079a66beb76465c
SHA1 3b4081907d5bf029f53ffbffc0be3bd80b5d293f
SHA512 925b541085e644420c092e5a3fbc47c746240a0dfff786ec1a5e5cb06022c122e9041dfe2b97a9514b254862c6ea74c359a2412ace01c8f53e99eb25a39c133d
SSDEEP 384:fdsOT01KcBUFJFEWUxFzvH04eCiAfWxQEgbx6lgsRyF:fdsOTLyUFJFEWUxFzvUEmQbV6llyF
MD5 SHA1 SHA512 SSDEEP

Submit Download