Analysis
- max time kernel
217s - max time network
220s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
24/08/2022, 23:43
Static task
static1
Behavioral task
behavioral1
Sample
Invoice-08-18-unpaid-164-document.iso
Resource
win7-20220812-en
windows7-x64
3 signatures
600 seconds
Behavioral task
behavioral2
Sample
Invoice-08-18-unpaid-164-document.iso
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
600 seconds
General
- Target Invoice-08-18-unpaid-164-document.iso
- Size 1.8MB
- Sample220824-3qz5vsdfd2
- SHA256 76d3dd668a92b65468e9a7672b925588466fff8956210f0817b22908a34465c7
- MD5 f51ce7ea32f06721d5ecabaa3c4e98c8
- SHA1 ce8ffcbab721486cffa0d690610bb7e5bc869d63
- SHA512 c398b2e7f672974cd146d17e346473f56d02260ddf7259c15bf60b43257fbd4c496c4253998856724b63ed3590f9347842e6ca28cf4a94f3e5616a1ca1d43820
- SSDEEP 12288:dv4esk2u+OOK5N72Y2MC7T9HmAhbKgRNzQP19:94esk2u+OO66Y6vJk0Q
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
icedid
Campaign
-
3071892330
C2
-
toughflatlying.com
Signatures
- Blocklisted process makes network request 6 IoCs
flow pid Process 102 1516 rundll32.exe 104 1960 rundll32.exe 107 4396 rundll32.exe 117 1516 rundll32.exe 118 4932 rundll32.exe 119 1960 rundll32.exe - Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: NOTEPAD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 2372 460 WerFault.exe 85 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1516 rundll32.exe 1516 rundll32.exe 1960 rundll32.exe 1960 rundll32.exe 4396 rundll32.exe 4396 rundll32.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 700 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeManageVolumePrivilege 560 cmd.exe Token: SeManageVolumePrivilege 560 cmd.exe Token: SeDebugPrivilege 700 taskmgr.exe Token: SeSystemProfilePrivilege 700 taskmgr.exe Token: SeCreateGlobalPrivilege 700 taskmgr.exe Token: 33 700 taskmgr.exe Token: SeIncBasePriorityPrivilege 700 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe 700 taskmgr.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4992 wrote to memory of 3964 4992 cmd.exe 117 PID 4992 wrote to memory of 3964 4992 cmd.exe 117 PID 3964 wrote to memory of 1516 3964 cmd.exe 119 PID 3964 wrote to memory of 1516 3964 cmd.exe 119 PID 2500 wrote to memory of 1960 2500 cmd.exe 123 PID 2500 wrote to memory of 1960 2500 cmd.exe 123 PID 1728 wrote to memory of 4396 1728 cmd.exe 126 PID 1728 wrote to memory of 4396 1728 cmd.exe 126 PID 32 wrote to memory of 4932 32 cmd.exe 134 PID 32 wrote to memory of 4932 32 cmd.exe 134
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Invoice-08-18-unpaid-164-document.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:560
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 460 -ip 4601⤵PID:3924
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 460 -s 8481⤵
- Program crash
PID:2372
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4700
-
C:\Windows\System32\NOTEPAD.EXE"C:\Windows\System32\NOTEPAD.EXE" E:\5.bat1⤵
- Enumerates connected drives
PID:3708
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start 5.bat1⤵
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K 5.bat2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Windows\system32\rundll32.exeRunDll32 sta4m7om.dll,#13⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1516
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\5.bat" "1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\system32\rundll32.exeRunDll32 sta4m7om.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "E:\5.bat"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\rundll32.exeRunDll32 sta4m7om.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:4396
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:700
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""E:\5.bat" "1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\system32\rundll32.exeRunDll32 sta4m7om.dll,#12⤵
- Blocklisted process makes network request
PID:4932
-