Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26/07/2021, 15:13
Static task
static1
Behavioral task
behavioral1
Sample
core/cmd.bat
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
core/cmd.bat
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
core/kind-.tmp.dll
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
core/cmd.bat
-
Size
185B
-
MD5
53cc0ad8caf01d4c06d01df2a27726a7
-
SHA1
a4331d3783ce365f2bb5c62ac4cf10ff375158c2
-
SHA256
76c39b81fd9f933319b5f23167aee5b4fdba73db84f2f72bb4304dd9076ae2e7
-
SHA512
c4161c60580e9cbbe76a38fb4a463b70955a2223575881d59ce3ee6cc3cb6f2e30727df7fc405334bc4483e4db472c1cdeb6f9742b36279c93cb992423b0688d
Malware Config
Extracted
Family
icedid
rsa_pubkey.plain
Extracted
Family
icedid
Botnet
524571734
C2
gsterangsic.buzz
oscanonamik.club
riderskop.top
iserunifish.club
Attributes
-
auth_var
6
-
url_path
/news/
Signatures
-
Blocklisted process makes network request 6 IoCs
flow pid Process 5 1820 rundll32.exe 7 1820 rundll32.exe 8 1820 rundll32.exe 9 1820 rundll32.exe 10 1820 rundll32.exe 12 1820 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 1820 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 1344 net.exe 1632 net.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 972 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 328 systeminfo.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{E6AB5750-EA5C-083E-FBB2-6959D4C53546} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\CLSID\{E6AB5750-EA5C-083E-FBB2-6959D4C53546}\ = ed707b483d42a02772af52da5469d5e090d7db558eaa02e1a94507739cb0cecf0eeed9d146c4323e6ea9158cf2c853b2a1b25ee48be17915a4905253a0fb67df781532cb1b5811b2ea6fd1cc92f2c6e2742bb274e14cdda3399f606fc40aa807686e218bf6651290bd7e664f34d9b4dee7c78bc3be72a2713e7125b92e157acfd49681bf0f38ea486d37d583a21671204f47d88de69bac919460d28782bcd3cfef1ff4f07634824f1bde8a33584f34cb9013e1e8fb723d10c7f9683ad20cd78be394a49204af09cc8fbc8cb0170c0003cd06e7fe76b21de9ef7da8096bf586224b8dfbfa63ad5c0351da99bf8a321ff85f6b2c50494ac708f1f87d3c9d8d27cf031ac1097d2a1e20a1027dad81bec1edca90a11ecc8a384e4efb0f7623d49be79625d3e5b01954db9abf8ab25f180fb71feff5e27435d8cc176032568205ef6e2292ee7ce768264dd02cf0dba908f66035d90ed39d22d9cf973ac6189a81a90d726a2a22405cdc18fba23ff39d3e5843bb106a27ca81a356e3e8732517ce7129c0c1463049214bd4e5a5bb31a117e763b50beb6b36891c67a8df22df164600a1e021cd15c59cf6d5ee8c04653653b9992a53523d91075ada8e65d784027cf37f879b rundll32.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe 1820 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1560 WMIC.exe Token: SeSecurityPrivilege 1560 WMIC.exe Token: SeTakeOwnershipPrivilege 1560 WMIC.exe Token: SeLoadDriverPrivilege 1560 WMIC.exe Token: SeSystemProfilePrivilege 1560 WMIC.exe Token: SeSystemtimePrivilege 1560 WMIC.exe Token: SeProfSingleProcessPrivilege 1560 WMIC.exe Token: SeIncBasePriorityPrivilege 1560 WMIC.exe Token: SeCreatePagefilePrivilege 1560 WMIC.exe Token: SeBackupPrivilege 1560 WMIC.exe Token: SeRestorePrivilege 1560 WMIC.exe Token: SeShutdownPrivilege 1560 WMIC.exe Token: SeDebugPrivilege 1560 WMIC.exe Token: SeSystemEnvironmentPrivilege 1560 WMIC.exe Token: SeRemoteShutdownPrivilege 1560 WMIC.exe Token: SeUndockPrivilege 1560 WMIC.exe Token: SeManageVolumePrivilege 1560 WMIC.exe Token: 33 1560 WMIC.exe Token: 34 1560 WMIC.exe Token: 35 1560 WMIC.exe Token: SeIncreaseQuotaPrivilege 1560 WMIC.exe Token: SeSecurityPrivilege 1560 WMIC.exe Token: SeTakeOwnershipPrivilege 1560 WMIC.exe Token: SeLoadDriverPrivilege 1560 WMIC.exe Token: SeSystemProfilePrivilege 1560 WMIC.exe Token: SeSystemtimePrivilege 1560 WMIC.exe Token: SeProfSingleProcessPrivilege 1560 WMIC.exe Token: SeIncBasePriorityPrivilege 1560 WMIC.exe Token: SeCreatePagefilePrivilege 1560 WMIC.exe Token: SeBackupPrivilege 1560 WMIC.exe Token: SeRestorePrivilege 1560 WMIC.exe Token: SeShutdownPrivilege 1560 WMIC.exe Token: SeDebugPrivilege 1560 WMIC.exe Token: SeSystemEnvironmentPrivilege 1560 WMIC.exe Token: SeRemoteShutdownPrivilege 1560 WMIC.exe Token: SeUndockPrivilege 1560 WMIC.exe Token: SeManageVolumePrivilege 1560 WMIC.exe Token: 33 1560 WMIC.exe Token: 34 1560 WMIC.exe Token: 35 1560 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 916 wrote to memory of 1820 916 cmd.exe 27 PID 916 wrote to memory of 1820 916 cmd.exe 27 PID 916 wrote to memory of 1820 916 cmd.exe 27 PID 1820 wrote to memory of 1512 1820 rundll32.exe 31 PID 1820 wrote to memory of 1512 1820 rundll32.exe 31 PID 1820 wrote to memory of 1512 1820 rundll32.exe 31 PID 1512 wrote to memory of 1648 1512 cmd.exe 33 PID 1512 wrote to memory of 1648 1512 cmd.exe 33 PID 1512 wrote to memory of 1648 1512 cmd.exe 33 PID 1820 wrote to memory of 1560 1820 rundll32.exe 34 PID 1820 wrote to memory of 1560 1820 rundll32.exe 34 PID 1820 wrote to memory of 1560 1820 rundll32.exe 34 PID 1820 wrote to memory of 972 1820 rundll32.exe 36 PID 1820 wrote to memory of 972 1820 rundll32.exe 36 PID 1820 wrote to memory of 972 1820 rundll32.exe 36 PID 1820 wrote to memory of 328 1820 rundll32.exe 38 PID 1820 wrote to memory of 328 1820 rundll32.exe 38 PID 1820 wrote to memory of 328 1820 rundll32.exe 38 PID 1820 wrote to memory of 876 1820 rundll32.exe 42 PID 1820 wrote to memory of 876 1820 rundll32.exe 42 PID 1820 wrote to memory of 876 1820 rundll32.exe 42 PID 876 wrote to memory of 944 876 net.exe 44 PID 876 wrote to memory of 944 876 net.exe 44 PID 876 wrote to memory of 944 876 net.exe 44 PID 1820 wrote to memory of 1872 1820 rundll32.exe 45 PID 1820 wrote to memory of 1872 1820 rundll32.exe 45 PID 1820 wrote to memory of 1872 1820 rundll32.exe 45 PID 1820 wrote to memory of 2000 1820 rundll32.exe 47 PID 1820 wrote to memory of 2000 1820 rundll32.exe 47 PID 1820 wrote to memory of 2000 1820 rundll32.exe 47 PID 1820 wrote to memory of 1344 1820 rundll32.exe 49 PID 1820 wrote to memory of 1344 1820 rundll32.exe 49 PID 1820 wrote to memory of 1344 1820 rundll32.exe 49 PID 1820 wrote to memory of 1632 1820 rundll32.exe 52 PID 1820 wrote to memory of 1632 1820 rundll32.exe 52 PID 1820 wrote to memory of 1632 1820 rundll32.exe 52 PID 1820 wrote to memory of 1428 1820 rundll32.exe 54 PID 1820 wrote to memory of 1428 1820 rundll32.exe 54 PID 1820 wrote to memory of 1428 1820 rundll32.exe 54 PID 1428 wrote to memory of 948 1428 net.exe 56 PID 1428 wrote to memory of 948 1428 net.exe 56 PID 1428 wrote to memory of 948 1428 net.exe 56
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\core\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\core\kind-.tmp,update /i:"license.dat"2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Windows\system32\cmd.execmd.exe /c chcp >&23⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\chcp.comchcp4⤵PID:1648
-
-
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:972
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:328
-
-
C:\Windows\system32\net.exenet config workstation3⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 config workstation4⤵PID:944
-
-
-
C:\Windows\system32\nltest.exenltest /domain_trusts3⤵PID:1872
-
-
C:\Windows\system32\nltest.exenltest /domain_trusts /all_trusts3⤵PID:2000
-
-
C:\Windows\system32\net.exenet view /all /domain3⤵
- Discovers systems in the same network
PID:1344
-
-
C:\Windows\system32\net.exenet view /all3⤵
- Discovers systems in the same network
PID:1632
-
-
C:\Windows\system32\net.exenet group "Domain Admins" /domain3⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 group "Domain Admins" /domain4⤵PID:948
-
-
-