Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
04/08/2023, 02:06
General
-
Target
d.dll
-
Size
527KB
-
MD5
60f8d1993043c054e0ddb91e11fc184f
-
SHA1
80d274ff4278baff08418d48c647c8c0604db3ab
-
SHA256
09a537a7c4bed33cfb33ae7d7b5360b52e6c1396a893b67b5e71acc28e3f74c2
-
SHA512
007d9ed82a9cb612882afa70f9482d078f7612e913fd6f4b351307b37c5eaaededaf5b1a2aa1ba0a2ebc48888a475b168b5ea2ad3ef1c35a883daf8ece9f795b
-
SSDEEP
12288:jymcE1WefvUdDpWcc/9scDp6MGuXxGSthFLEXCRF3MK:e6fvUdDp0/9sY6MGuFoCRF3MK
Score
10/10
Malware Config
Extracted
Family
icedid
Campaign
43832328
C2
ospertoolsbo.com
Signatures
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d.dll,#11⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /s /k pushd "C:\Users\Admin\AppData\Local\Temp"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 d.dll, vcab /k chitos76852⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
4KB