Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 20:22

General

  • Target

    76447fec55fa1a5623e0274605e4134184425fdf99c01b7003ff0b3aa6eccdf2.docm

  • Size

    2.1MB

  • MD5

    3325bd0f3dace44f9eac6d8a47b6b0e1

  • SHA1

    a3ab8a9783a6ad34d165f928c4603f59b529863c

  • SHA256

    76447fec55fa1a5623e0274605e4134184425fdf99c01b7003ff0b3aa6eccdf2

  • SHA512

    1fc1a826bda4f2fa50fcb4cb14584feec21b30d5942de53b9d04f8a668fb826cd752b3220386fda75c674393ee1f8b78d3611b9d4b6230e6f7419a838a60621d

  • SSDEEP

    49152:CGMZCMYhgl5R/4NurkXDYqM/JDK6M3fKgDaJx:vMZCMYh0DHkX8hDK9igDo

Malware Config

Extracted

Family

icedid

Campaign

3281798692

C2

kolinandod.com

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\76447fec55fa1a5623e0274605e4134184425fdf99c01b7003ff0b3aa6eccdf2.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 c:\ProgramData\xxx.dll,#1
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\system32\rundll32.exe
        rundll32 c:\ProgramData\xxx.dll,#1
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:812
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:864

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • \ProgramData\xxx.dll

      Filesize

      703KB

      MD5

      2fc472322e6f3ce3e8d9e5b2282f7934

      SHA1

      e6e976e412f2fb1d9851ecaed768c2686c6c2b87

      SHA256

      29515cee05595b3fe844a0c8b6e3d9d174a9e7ac15f956375d2590c169da34d1

      SHA512

      5b29d8b3ac2eaa88b993af3726c2caf0869972b80e5aad70504c6d9b96edc4fa1bec255d3ab3f9edaaa7832cb72f41765bc9a516facd09e0f5b6f3636c76f0a0

    • memory/812-115-0x0000000180000000-0x0000000180009000-memory.dmp

      Filesize

      36KB

    • memory/812-114-0x000007FEF6400000-0x000007FEF64B4000-memory.dmp

      Filesize

      720KB

    • memory/864-122-0x000007FEFB5B1000-0x000007FEFB5B3000-memory.dmp

      Filesize

      8KB

    • memory/1256-70-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-93-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-71-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-73-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-72-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-75-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-74-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-77-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-76-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-78-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-79-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-80-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-81-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-83-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-82-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-84-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-85-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-87-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-86-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-88-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-89-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-91-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-90-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-92-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-94-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-54-0x00000000720A1000-0x00000000720A4000-memory.dmp

      Filesize

      12KB

    • memory/1256-95-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-96-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-97-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-98-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-100-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-99-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-101-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-69-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-68-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-67-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-66-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-65-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-64-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-63-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-62-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-61-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-60-0x00000000004AB000-0x00000000004AF000-memory.dmp

      Filesize

      16KB

    • memory/1256-59-0x0000000070B0D000-0x0000000070B18000-memory.dmp

      Filesize

      44KB

    • memory/1256-58-0x0000000075C61000-0x0000000075C63000-memory.dmp

      Filesize

      8KB

    • memory/1256-57-0x0000000070B0D000-0x0000000070B18000-memory.dmp

      Filesize

      44KB

    • memory/1256-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1256-55-0x000000006FB21000-0x000000006FB23000-memory.dmp

      Filesize

      8KB

    • memory/1256-123-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1256-124-0x0000000070B0D000-0x0000000070B18000-memory.dmp

      Filesize

      44KB