1a3ef81297f8445b27e7444b6bc529a097eadf8e4437b6964e4d725918139345

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Size

1.4MB
MD5

0050a749a20fab483d1ecf943f63d566
SHA1

5af6f1d0630e0e9b6683bc384dd5b56c4b571657
SHA256

1a3ef81297f8445b27e7444b6bc529a097eadf8e4437b6964e4d725918139345
SHA512

6f7a4761be9dbae066b906ba26042f96887dfc63e412414400f4caee30786d9e53048101b531d4ad1faf9dd273a5a3514028b54e016e585a4d50454a5562e4f5
SSDEEP

24576:NTLBd7xejG61lzFhE6WZXJDiY3Bf78QFnTojcZfUTq:NTLBd7Yuh5GY98QBTRZfUTq

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043aa109a98bae7448a76cf07313f86bd00000000020000000000106600000001000020000000d459b45f03a7a76ea44986aaf7363584789577c71c82e0f7e8150f68d96888a7000000000e800000000200002000000028ff19996281354e0c9f04ccaabda10eeb76844144e56f2dd65db6c82af357b090000000931e8a528930d2aa76c05239e8a420c00f8edf6a828a482d525c8564c73c18e6b170bdfa91ade3464424cb3bd26107e5fefaa40bbe63e3e50e95f05c390076088abf48d82436f85b384627ffee127da4ef740710e8b6cd391c3896293f57a18f4aca79d8c17e7a407893f626e6e87c77403772bc3a6053a593711f5e00fe0c9a37458845b916f8e77a656414a3ea9dae40000000083f437a237a0ca0c3fe23c5a304b3d393edd834f52e9ec7d8242ce0f744e74b09e6a908afff87cb6221efa698e498285bd25af6c1ec15f06623d39215ed30ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10fa3a86789ddb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B07D6561-096B-11F0-B729-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043aa109a98bae7448a76cf07313f86bd00000000020000000000106600000001000020000000d08a83424109c7304a26ccd3a4ee21b81b7f9c70626e9adb59507f6d7c1b86e5000000000e80000000020000200000000456ecfde47577b482b8d76eb3e2abb00adfda021dea82f8a090b1ff9697d5fd20000000d47db3eb2f82d49c3662c0416d9f7f4d55598efc7704c1bec2acb924078135ef40000000dae9ceddae7290fcb50085f4595ca2718c14d6016857db269a8cf5ed67f841f681483f353ff5c038793aef31c07640f55c032fcd17c7fdbbaed886a28bf39ab7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449063725"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.playlist\ = "AnyVideoSoftware.AnyVideoPlayer.playlist"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Videos"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe\" \"%1\""	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Wow6432Node\CLSID	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\.playlist	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Wow6432Node\CLSID\{C7D55E60-9876-4f4c-AE02-EA050EE9FBB8}\ = 9d89bbb29cbf91ad9db08daa9db095afce86ccb29d8699b298cd94cece86c8b39ccd9db3989591aa98cccc9f9d9598cb9d86becf99bf91b3ce86cbca99968db29cb0cbcc9986959f9c968ccf9b968ccc9cbf91ae9c89bbd1ce86a79f9d96c8b29bcd88cf9dbfc89f	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\ = "Playlist"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Wow6432Node\CLSID\{C7D55E60-9876-4f4c-AE02-EA050EE9FBB8}	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\shell\open\command	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Wow6432Node	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616193"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\DefaultIcon	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe,1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\AnyVideoSoftware.AnyVideoPlayer.playlist\shell	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe23000010001d9b9818b5995b45841cab7c74e4ddfc00000000	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2912	iexplore.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2912	iexplore.exe
2912	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2912	2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe	31
PID 2200 wrote to memory of 2912	2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe	31
PID 2200 wrote to memory of 2912	2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe	31
PID 2200 wrote to memory of 2912	2200	2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe	31
PID 2912 wrote to memory of 2624	2912	iexplore.exe	32
PID 2912 wrote to memory of 2624	2912	iexplore.exe	32
PID 2912 wrote to memory of 2624	2912	iexplore.exe	32
PID 2912 wrote to memory of 2624	2912	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-25_0050a749a20fab483d1ecf943f63d566_icedid.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://www.anyvideosoftware.com/any-video-downloader-pro/download.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
d8da9d244f2842304a81fee54984b8ce

SHA1
f623175584db7cba0b6138d96869e66f4447f7eb

SHA256
478f18fc4a1a8ee9d4e8c3977e6deef35a67e43507189ad6da8ff63a1da475de

SHA512
4f62f9c5ec2c4aa939bc950d668d332abf6edcc28b217412ebbaf974047c6858daf96f446476fcb6363fffec7b705b2c38522e6551d4c86f154ac16086165a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35693C33E0958A33839894EBDA2FF27F

Filesize
472B

MD5
ec26658a2c50feb53da564e5fc49b085

SHA1
35fbfdf7d94c8b645aec0d4ed49ef547293de8e3

SHA256
42caf35ce0fa31bc9cf383252abafcf79b1da9d71e6ead290b3e509bffc83f73

SHA512
a287f14442d08f7b4f91d0ceed4662d8d3a3dccce2d2d4c724ab3142844465b0eb5a7319d46bdc73ac41677378ce165447e2101cd105bdd377a2b0f8e604fd42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
9243562a066395834ae5e0596058bf7c

SHA1
7717a58dd2354fc12fe1b7ae6736579a0c6f7b67

SHA256
bc439d28c6860771ea1746266bc29f66c813aeab1c9dc084d46375fe50e0a4fc

SHA512
debad4940211e31864908afc6a63fcbc121c3b3813efc7cbc1e64130c1c5acf924e37d1e217384fb0ed0fe0c40b93800efd26d50ec857bfd52d4c4be0d9cb676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
11df46fc1f758a1f428180bf4e88f2ba

SHA1
5f96dc8d99a7c561b4f37a59e27c2ad02ea1fe80

SHA256
07e33fbf04a60fa032a7b673dad80c7191116fa89844ea4de072d67dc8f79af4

SHA512
a3dbeee6d7b92c8749a140661bbf844605145af3ae49e7baaa69167e6d3d2d2ed8012f819e2f3837896381291330c9d30835f4351e4bd36a521c6284b148fa93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35693C33E0958A33839894EBDA2FF27F

Filesize
480B

MD5
6fac911ad2af4dbbb76e278518a29706

SHA1
9e76dd6e1697a5476f8c7897c35ae9b95e38d0ee

SHA256
dc04633635e9ee4c6bc8e4445f80f3450522c6a1512f5940a93a157c8ca5c320

SHA512
8b20c7e2f0b22594d80c9a5e4309de4804b63be18f70397b464b3222a65de0aa5a5c7f29d202a2d8e27823209d22f859e7d636ba7e2e5da23daf336f092e9f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e02ecf14517cdabbf77b8efc654e0963

SHA1
0b980de66e30a5677d762a3b10167e059ce9d78d

SHA256
e3a295ad66c19520c9facc1926ec7da70e6aa6a88ac9a52ee31aafbf192d83bd

SHA512
f66d68be7de0943b12f2400f90070e2c57e0f5002a0af7ad20f9a036956878e344b59b061056d58e4a71403b06324d7e4769518e24fa7013983e0ab0b494d148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d3652f302ddd16ca366c3300478a485

SHA1
a96a03d9191b590360bae55cf2468fe26f290fd0

SHA256
d869cd7109f2e3af9aab1985699a572c3a0042ff6d7eb2a90e91dd51cee1eac5

SHA512
057aae19b7933c465826b9e273672e79d664f2af655ab97378499930a10237e298444d7b866b307563e906547c7b9683100890645b1fac8bc7653315806ef7e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f03fd383b9428c951cac53781297ffd

SHA1
d15a3bcc0ee470acdba36aa510c9ef9c7d5807e5

SHA256
9eeb11d1cd17c73886de93b974a9022294075094ac372e688f76742b7fec041a

SHA512
6a7b63afa46793ff4be1936d4b2bf26adbedd90a089c8d9b3475b3fbe90d3783119bc9fc2e469d9e11e1f48be7b541806c62bfc20777373b020def4c548f34fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
51e32e0b6e77460fcf2f0f79efd11387

SHA1
31f8a0721caf6b5722ed458aa3c89bb3fe2d7c62

SHA256
a55be059c1339c876dbc7a8e4e50ab8842bac1f0eea221d3975de8deee5f6558

SHA512
9b6bf64f86c897a24fe00d77a2c5bf3f5613ff69946e84041819be6bc25aae13636f91dd43553278e831612a3873861d65c72ea421529208e9a216019f29fe85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
245e6651985e50b3025e0ae007a3913d

SHA1
44ff084a2ff05442f22839216d754f1e15cf68b4

SHA256
3edb605df367ef17fd8a4c5a9b469004398373904797dea89e14cf4408ed6ab0

SHA512
40c1f9a52da424dfc284e91476a49a2503b448d65b94909b167eebc7afb4b66dd2958c6b9cfcdf6f975576e2744ce0bee3acfaa743fb08f558134899a5ae74d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56cbc519685dbbe9442991a22dbc0d77

SHA1
e922fcddbf301a9534a25d185941e57f2a4e45cd

SHA256
2c3abb3a4ce22fe9ee57f01329fe978e9327e009557ef3a68b7d185c32454ae5

SHA512
2d17f64bf4fdc8c5089137fc08b6fa66c28d632d79964d8fcbdd5df905bcfaa2d47f81fb9fbab4c2f32f185c9468ed59c008c56bfe0f13198d8950f8c5700945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb88a837725d63d055fa434b34c8715d

SHA1
9ede4d3ab197a15ceba22cb3fac09c266e3f8530

SHA256
0633a9416e4d9b36851bde5c350fed7d5d9044350953d7a3b297dfb65527055f

SHA512
ccdec536eac0947be8c9a436598462f08d4c3e0d8b088e41388a6e9fbbde9d2f6e2b77a543ba911fe640ffc1ed97b74b75e5c787b7cee3e6ca82c01a70ac050f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2a2986e92a0a0361d9aea83153f35369

SHA1
a0eb0a391b09edb9e1d7cdbf2812506506c02a40

SHA256
31d60e14ad4c04b74e718c70709aa552634f8859a3e33eaca1a4fbdd25d83652

SHA512
fce3d19bf3d9015cbf44f0a77cd71ddd7cd3aa0b59d5032f07c2abfb4c470adbaad8baafe961ef14c652d4cf975854b6b667132acee9bb41d2872de9a183f802

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcd1e7f6b0f29cd6f0fd007b643fa18e

SHA1
72cfc2d11086735eb8c069ee050a8a6d64289f21

SHA256
93cf9c29ad9a9761baaea9cae86538c490200d3243f3653267fee003fa8cbb79

SHA512
153739c6d4389b0eccbf5de1087784c573b0eba606e5af346dac5ef85ed9e5653c9727bb9623d307a00ce7c24dad77e1cf6699dd654ed3b932d472164865cfdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d501e8e0d20b8fd465d483711ec251c4

SHA1
41cbf830341d9b74f9c6b7306b8324395e557391

SHA256
12adbb68d742a725620fa1ae113f361e8f443ba6ab52612c5a6983722d33101f

SHA512
0d2d1733e71800b5408d64a964228d4f18f15cf2daf950b0815bb1df64e0d1ef4ac8225469db6168f39df6c5f7b5aa2ac9799f9bbc38c0cc476c49606edc74cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3a628b3bbae82c5035fb808af9d8b69

SHA1
6389fd23723af4a57ff06fdd3ea4d3888cb245bf

SHA256
941d663ef96885850a44ec08b3047b2925dad8f0f2db29c144095698e6164e44

SHA512
b0a1b8e643120f8c9857d310f3b8962d210e4368684a74ee0d0d91f99ab5e0f70f134a2fffd407d9f468383a5e65faa7a393906ab640a33cb468c7d78b7e6b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b541fb18fb7f82eb1ef244ee2233062a

SHA1
b9c5e1d64d928f63c428c3f3a4033a972236fc0d

SHA256
1016ca83ef46c48d2fb6d7cf2f1bd8cf4f3a02f49109a4d6a9340d614b3517f7

SHA512
b8295f16b2a0bee137a9b950989e08f41b3b718fd295bcb60d21979cf9353029407ec643b9834cf390b20cda2ff617f78a42e390d4bced9598c36318f2b07284

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
488742010f594319561857d6190b8525

SHA1
6f2ff6d4e01c0c51ba1f4abc467d74e9912f0bd5

SHA256
95fc1501cc55731bd465b530bbc26d5f806b2053107c1547f67f12435f744821

SHA512
cba002ea74d9ff257bb02d7d8f2d5be263ab988a80a0c2263125c0c2d0f73492b2b74a895504cf6eb4f1f4dfa8595629d446c2df636c7e600d61de872af27a0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
222022332fe17737650bb83a56eb6844

SHA1
c35af424c5493118d6b23749f0efd8ae23e8f8d0

SHA256
85af85b9db34c8ca47c60bbc93773312b2c315c1e14f6de17f784d9658cbe431

SHA512
4f1a2cf91a95772dea8b96591fc7689c6dbd45d0c86e7c1cb352093481603d0844189079c9b1bde73757395a589832ae7d4dc5212f537a0f1853738a796fdf51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7710d1d12900e8834673125032313639

SHA1
ca4d5818bd7a481a45fe420e3da76a8d58eceeef

SHA256
b29fcfa3c236ded2b29a38b314b7ddce38b3f41912099a65d5945e9a6b406883

SHA512
d8f3b69324da94acbe7efdb5b81b8bc1d2a0c40ffaba43356bfbd69421e6a68f2440c96fbefb34c0854cbe818be68e6d4df5f0e54d721b7f67257d6006836c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0426cd273e5615a3a074accfa471aae6

SHA1
7547089ecb2cd4cbb8752c14ac9300d75da984aa

SHA256
71e04b806c9a6c0e4cb0826e0d6a1c1abd7d4962651563d76839d2fe59725a4e

SHA512
9bfd3a166f301505209aa3ccb38ab79e6883ae5bd174f98f9b596ceaa532781f051ac119ad71f15bc3709c82cc647713860b8183f3123464e10ebecdfa86c55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53ecb207afe4c7807a8bf35e7e48b7b0

SHA1
5c3b5f829d12f2c6f6da78ebb7f1f1d0c1316f59

SHA256
52c413f7686f72619a8f93b583de3b88b2de2ce1c35778b8a65543936aa55a72

SHA512
cbe13fa66076f62f13d046a35ab74c8c2c3bfed6fcb07027fc8cd3fe4316f6655b05d2f1bb72b05f0cbb9461aaf1bec30abbb2290580c2f41f5574ecd1d2f06c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ad9a1ad9cc95dc7a3e24ac8569c8042

SHA1
b66d63877d792cb02ec7ef6a63a6e59a41765fef

SHA256
526f44fcf8b5d4c4214b1c003e5a43380f7cfea1c5203c5825e76b9d8d0ae088

SHA512
fd8804819c438abe7bdc49055a7e65cf47375c1133bc67d65e9f09ce63d7dc83ee2d4d6bb829b60b7a4d634392ed9c1493f1d76753940108c0d03320afeea21d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
586d8132c8ef4933bcaf0f008dbf95be

SHA1
bbcb82845fdd6995ed45f6d2ca610f0e2eb9a6f7

SHA256
6d6d38410a412f2279fb5c6027fff2b012532350a7fa5a8a792a553576102255

SHA512
8cdb9936f5bd05d9b75dc23a286947ba4aabc392419efc3cb4c7294c212b652227be2a0314d4066ffe1229c846448ee5b5c59accbc606ae95b7e306e8d406db6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34ea541f2373be0ce25404def684cc4d

SHA1
7747a3d7d22d1f64fb6f8b97525565d66d21fb64

SHA256
ccef5b5dcab5cb5ffd3ef66bc52b9eda3d5e582937a873cda7ad68a9173723e1

SHA512
1af967ef03d335d813bc01f279c30ab367eddeae5fdceb6583da11934816cc8247642c0bf4ffedbd00d668234b07c2ccd740e0206c8062d13a0ac998db78a273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
34fcc1840abd9904564ba47f1880192e

SHA1
ccc08258914830372b9db746c49c87a711996876

SHA256
b7e8d24e8a74af27793c50b8ed6e75a7c0bd824eaa79e92b26671705cb4556d6

SHA512
9f541b6683aa52cb19ae3467e2f27e4899dd2a4cce4ca043d1da4e04e51dfee6dce0beb95e9b115ccbbc1dc570780c4b88afd3db5d854b94db1ef65cd0e661f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
56460108c68a4fb9b28843e6cdd16175

SHA1
a24f2ae48e09b6033c170f2988d9c769a8789ff8

SHA256
7893cdd579c65e2bab19e1117514efda5aecc74b530d41c2ecde68e09e982bac

SHA512
a5752b368ba7d5315fccfb0352bebdec37828fb54528a7e533c3372400a4df49e72e4cdbefb6143cfecdf87bebbfe686e5a4218c710d3ac57e9450bc37eaa313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\njqq61f\imagestore.dat

Filesize
8KB

MD5
9970b3a0daf55e2f9a4e98d5eb46316d

SHA1
99dae1e683eaf2f58b2e528ab7cb18129d086730

SHA256
deba82ee001cba88b06e58c267859cce497e0f514d4ddcf1f89986a05fc82005

SHA512
47bac066269a81fb960c6b4f23dd846afcc3dfcebdfa0997756ea197fb646b53821b51adcc29747883deb97913c60514092b9ea471b50dd38b60db2e5fba06f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\favicon[1].ico

Filesize
7KB

MD5
0cb9d3073c2462b90662b32eeef7b20f

SHA1
1f15873f9d7e83b0c39a785ba1f3c1edabe9067e

SHA256
bf041a5cbb5cd433da45b1ceb240b01796c7b8581545c3520796ddbc587c9d7d

SHA512
b313ce1ca621d59a4c42a0fe015fa27aef4bb1974685ec0cdc3ec0366cde0e93c56cb7c0f2575758af925ab7532899b1fea3c7cbd9b0bbe4f10ee5acc119b74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC469.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
memory/2200-37-0x0000000004DD0000-0x0000000004DD2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads