Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/09/2022, 17:25

220909-vzhceagfh4 1

09/09/2022, 15:18

220909-spykjaccbr 10

09/09/2022, 15:08

220909-sh2zdaccaq 1

09/09/2022, 15:04

220909-sfpw2agde2 1

Analysis

  • max time kernel
    102s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2022, 15:18

General

  • Target

    fastemailsystems.document.09.09.22.xlsm

  • Size

    3.3MB

  • MD5

    c31319d66a1caab0aea47c65ab2b0897

  • SHA1

    b0b3711aac3683ca6bc8975f0686987a833cbc3c

  • SHA256

    3e8b5d4ac62a25e6c08b99954ee66559a8b758a4a05d5cd8a2a1151bbd80016a

  • SHA512

    5e418ffa4790be551e0f228ff6e0f23fcd2b0861d26e61299168aefa70fe9598563d1c1222ff85362fdaffd81efb576b9f67e376a32c57d0ccaa3fbe05046994

  • SSDEEP

    98304:Y0cMQv/hDAEl7Xtpny6H41l+/Xd8NyU9QgfW:Y//VAa7dpny+41l+vdoyf

Malware Config

Extracted

Family

icedid

Campaign

3207262051

C2

audifastinggip.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\fastemailsystems.document.09.09.22.xlsm
    1⤵
    • Loads dropped DLL
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1500
      • C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.exe
        "C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.exe" "C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.dll",#1
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\system32\rundll32.exe
          "C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.exe" "C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.dll",#1
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          PID:1800

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • C:\Users\Admin\AppData\Roaming\58KBycsUsB7B.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.dll

      Filesize

      163KB

      MD5

      94c90a08262f15574b39eada9d0b041c

      SHA1

      76aa13af04a059e699a3f880831c1b0493917fbd

      SHA256

      fc09f20a9c60dec0abca50f80f47c27c9e888e43ce43c8e636ea2a9d9ea350a3

      SHA512

      d9ec9008bac08c50c46ec2115360ad5ac8dde5550b42765b2a187372db668d16eefb4b2d039998dd116f5cecba8ce191d9969b5b53d0f445f1243fc1652ddabf

    • \Users\Admin\AppData\Roaming\58KBycsUsB7B.exe

      Filesize

      43KB

      MD5

      51138beea3e2c21ec44d0932c71762a8

      SHA1

      8939cf35447b22dd2c6e6f443446acc1bf986d58

      SHA256

      5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

      SHA512

      794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

    • memory/1500-60-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

      Filesize

      8KB

    • memory/1672-54-0x000000002F1D1000-0x000000002F1D4000-memory.dmp

      Filesize

      12KB

    • memory/1672-61-0x000000007248D000-0x0000000072498000-memory.dmp

      Filesize

      44KB

    • memory/1672-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1672-86-0x00000000077D0000-0x000000000841A000-memory.dmp

      Filesize

      12.3MB

    • memory/1672-55-0x00000000714A1000-0x00000000714A3000-memory.dmp

      Filesize

      8KB

    • memory/1672-58-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

      Filesize

      8KB

    • memory/1672-78-0x0000000004550000-0x00000000046AC000-memory.dmp

      Filesize

      1.4MB

    • memory/1672-57-0x000000007248D000-0x0000000072498000-memory.dmp

      Filesize

      44KB

    • memory/1672-76-0x00000000077D0000-0x000000000841A000-memory.dmp

      Filesize

      12.3MB

    • memory/1672-77-0x00000000066D0000-0x0000000006787000-memory.dmp

      Filesize

      732KB

    • memory/1800-79-0x000007FEFB0A0000-0x000007FEFB0CE000-memory.dmp

      Filesize

      184KB

    • memory/1800-80-0x0000000180000000-0x0000000180009000-memory.dmp

      Filesize

      36KB