Analysis
-
max time kernel
356s -
max time network
354s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 21:09
Static task
static1
Behavioral task
behavioral1
Sample
Document_37_Dec1.html
Resource
win10v2004-20220812-en
General
-
Target
Document_37_Dec1.html
-
Size
221KB
-
MD5
3be804323d8ab42ec08a0d4422610087
-
SHA1
9ecd7fc9ac30ee972ef5437ba822d09c840205ee
-
SHA256
b0523c2b7ac08e53ec8868e1c1e7575905a43ab3a3be92b259d299233b919291
-
SHA512
5bcb5c6f1b4ee8bf75747285a7daa3102be6ce9c3587f88ea8e9fea3b2f68485813ca3c321e4730862cb3ad7cf02dd38f5eb8ca1c0ede31554930c00f54acc76
-
SSDEEP
6144:Qih/ffNwPfOD9NuUNSem3N/DkSf3Yx1VJSxt+ooYuwps:PfNwXxYoAK3Yx3JSxcYZs
Malware Config
Extracted
icedid
2271535685
Signatures
-
Blocklisted process makes network request 5 IoCs
Processes:
rundll32.exeflow pid process 108 4104 rundll32.exe 157 4104 rundll32.exe 180 4104 rundll32.exe 194 4104 rundll32.exe 198 4104 rundll32.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4104 rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.exedescription ioc process File opened (read-only) \??\E: cmd.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe -
Modifies registry class 1 IoCs
Processes:
firefox.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
Processes:
firefox.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\attachment.zip:Zone.Identifier firefox.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
firefox.exedescription pid process Token: SeDebugPrivilege 1176 firefox.exe Token: SeDebugPrivilege 1176 firefox.exe Token: SeDebugPrivilege 1176 firefox.exe Token: SeDebugPrivilege 1176 firefox.exe Token: SeDebugPrivilege 1176 firefox.exe Token: SeDebugPrivilege 1176 firefox.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
firefox.exepid process 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
firefox.exepid process 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
firefox.exepid process 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe 1176 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid process target process PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 4872 wrote to memory of 1176 4872 firefox.exe firefox.exe PID 1176 wrote to memory of 620 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 620 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 3908 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe PID 1176 wrote to memory of 4680 1176 firefox.exe firefox.exe
Processes
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\AppData\Local\Temp\Document_37_Dec1.html1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\Admin\AppData\Local\Temp\Document_37_Dec1.html2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.0.366742112\1611911187" -parentBuildID 20200403170909 -prefsHandle 1692 -prefMapHandle 1684 -prefsLen 1 -prefMapSize 220117 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 1792 gpu3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.3.1990760034\1319215769" -childID 1 -isForBrowser -prefsHandle 2488 -prefMapHandle 2484 -prefsLen 112 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 2496 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.13.2046971192\1267834586" -childID 2 -isForBrowser -prefsHandle 3768 -prefMapHandle 3720 -prefsLen 7599 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 3692 tab3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1176.20.1064066880\2519426" -childID 3 -isForBrowser -prefsHandle 4632 -prefMapHandle 4612 -prefsLen 7599 -prefMapSize 220117 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1176 "\\.\pipe\gecko-crash-server-pipe.1176" 4644 tab3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c logfab\phiVj.cmd NAcP1⤵
- Enumerates connected drives
-
C:\Windows\system32\xcopy.exexcopy /s /i /e /h logfab\offspring.dll C:\Users\Admin\AppData\Local\Temp\*2⤵
-
C:\Windows\system32\rundll32.exerundll32 C:\Users\Admin\AppData\Local\Temp\offspring.dll,#12⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\offspring.dllFilesize
161KB
MD513dc944a91cffd0385e29ea899a43af2
SHA1793cfb6887fd324583ab1df77ff5e96391a3887b
SHA256af5f6f066ffc8c375d6e4d1138d63da32014d7ea21b8b7582da0cd8b97794cbe
SHA512258c0c920f0e76f2b883f967cf73114890f61abbee0824d9b2e913623feaeb53c2b1179bc34df49627fe39459e1d9b20986186015fa0168c7b452eeba7449c39
-
memory/1220-132-0x0000000000000000-mapping.dmp
-
memory/4104-133-0x0000000000000000-mapping.dmp