Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2023, 19:33

General

  • Target

    2023-08-27_57f59bc5b7de1c9ca37bb525f41c6dea_icedid_JC.exe

  • Size

    2.1MB

  • MD5

    57f59bc5b7de1c9ca37bb525f41c6dea

  • SHA1

    708c3378a8dee003bf89fe06cb7989c7ebc10556

  • SHA256

    ec684bc95c150fadd902ee9ab8620e3e0392d32a652adb3c25665b599ef85376

  • SHA512

    43c3dbbf870496d1072cc1362753259eaffc2e759af116f51e35804efa76a9b27b56ac5593d8ec7fbe62e2095164cd7c808b40b19ef265e30e97c7694601e7ba

  • SSDEEP

    49152:nZggjeg1R8I9nAdCQQnfVNX7T4ZRWrbd:ff38I9ZfnfVNX7mRWXd

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Modifies registry class 59 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-27_57f59bc5b7de1c9ca37bb525f41c6dea_icedid_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-27_57f59bc5b7de1c9ca37bb525f41c6dea_icedid_JC.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Program Files (x86)\DouTu\DouTuDaShi.exe
      "C:\Program Files (x86)\DouTu\DouTuDaShi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      PID:2592

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\DouTu\DouTuDaShi.exe

    Filesize

    1.0MB

    MD5

    1348b2ee09b0b51707a2769dfe85e15a

    SHA1

    3c3542933f37bfec4cbe7b939f659548655258bd

    SHA256

    653c229856a8ff5c7f847b0f9da94853330aa3f97a23a5cabb324682909cd091

    SHA512

    676567c5427b56dfe585ebdb628993564e9be00ce995e17cb536339914bff2cdd86f403a73b1f277e2d13048cdd89b11d129ad79c24e7e68d1a71cb3c853e717

  • C:\Program Files (x86)\DouTu\DouTuDaShi.exe

    Filesize

    1.0MB

    MD5

    1348b2ee09b0b51707a2769dfe85e15a

    SHA1

    3c3542933f37bfec4cbe7b939f659548655258bd

    SHA256

    653c229856a8ff5c7f847b0f9da94853330aa3f97a23a5cabb324682909cd091

    SHA512

    676567c5427b56dfe585ebdb628993564e9be00ce995e17cb536339914bff2cdd86f403a73b1f277e2d13048cdd89b11d129ad79c24e7e68d1a71cb3c853e717

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    30973ca673f344bba3b7ef80df79cdf0

    SHA1

    e788c3e431969b946a05e78cd9822dbc654e8053

    SHA256

    cdbe5a0f82ed78ebbb4c41498f7c1dbb03c64e146f8d5f743a81fb70820d8c44

    SHA512

    2658220d8dc61a56636ea0d3911ac508c5c08211bb27ead19a405a013dc0d8e7c2a3b94997cf8b3d152c167b6afabb52a6933a3021ce8f0c2608e4f82191bf75

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    91da7cab97a292aeb469f2656a9cc33a

    SHA1

    845b1948094c5192f9501cfff6834d2983601aed

    SHA256

    0e8889ae6ae1885b1dcde4c5a3a887fdb464d04f57d29c10589878d339c92e47

    SHA512

    c1e93ee36924cf192d6c1735bdeea28f8476a28b41b7325596b464b7eafc3ed1ffada92da55e9535aac90c42017085db21b31e0b80f464dd89a9506ea629736e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    99ea0334890d35014ad482a8750ce066

    SHA1

    20d0296e02c1749d9a3f1fe65ea09c57558fc468

    SHA256

    1551d20e4a3cb881b1003785b82e016433ce7d97dc7e66ac1b3f8cad784cd6a8

    SHA512

    a491c7a60a28afa43535cd52b71f8df367cc7e4fb5f9dafeaf0cb83182f8b84ae7e57396855032e7757bf960674e6efe126f8ced1dd4aed52cd9da27c28c1673

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D3BGQCE1\hao.360[1].xml

    Filesize

    50KB

    MD5

    5958a55f4dcc60f4fed6d3fb976141d0

    SHA1

    88832a5b7a7894b5bc13adcb1ee2d3ccffec3b9e

    SHA256

    f94cd8479b1a6dc10a97df11b59dd760e49e79234243c2f9d42374e81fa8d062

    SHA512

    0f3cc176a360db53842a0d43abfb6a79f048012c5b34ebef3edda52471fa40e606cb636ed5cc5cb2bc5d9f533431dd6645f01d6e605a78eb65fbc809ad86416c

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\D3BGQCE1\hao.360[1].xml

    Filesize

    54KB

    MD5

    3a51d32bd18e85e43ef306c31299f6b0

    SHA1

    add1abcd74f8202d0b5928eea0ef5019406d8843

    SHA256

    f91e053eae4837484e67217105f18fc09018dd9dba6b4040490ace82c531fb23

    SHA512

    c2cee8668f3c74ece701b4c0d378a38d3d3becca2768b480950bafd158ad01b4e979c3d1dec8c75111785af05b3409c59ff069a359bfa3dba57746472c4cda3f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\186K4QOS\behavior[2].htm

    Filesize

    43B

    MD5

    969fd31015ec5344c2cef54101e23a56

    SHA1

    6a38854f2e704bcaf53712a65c79ef68cf11e06a

    SHA256

    52b2c9ce5bb6933e1397de740690260fe656c88970409b04beae1e098886c81b

    SHA512

    dd2f89935f7b17fab8d7a0d72c1d646df889d748e95d7c47219f54da0a510555582734ce08fcd49f997cbe34df0b518c5b5304703ec897f44bee943533bd0e2b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D205WY6X\QHCmHelp1.0.0.1[1].cab

    Filesize

    199KB

    MD5

    a5e9f71d790a91af4b963dc2fa3a2587

    SHA1

    135cc865e59544a838a61445fbdd44344a26f9c7

    SHA256

    b1714d74565f5ab6629e4fd29f2b6d5f325f1a5686f0295623e100d4a5e23d70

    SHA512

    9f02389bc8b33598e64cf17f624b1cde2fb67478513d0d4ab75d398ea59e0b25035eaf22b91293512672a0b463d35904bff8e4ee8f1e5d08fe563717a47d1415

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPR9MST4\s[1].gif

    Filesize

    43B

    MD5

    ad4b0f606e0f8465bc4c4c170b37e1a3

    SHA1

    50b30fd5f87c85fe5cba2635cb83316ca71250d7

    SHA256

    cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

    SHA512

    ebfe0c0df4bcc167d5cb6ebdd379f9083df62bef63a23818e1c6adf0f64b65467ea58b7cd4d03cf0a1b1a2b07fb7b969bf35f25f1f8538cc65cf3eebdf8a0910

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RPR9MST4\time[1].js

    Filesize

    27B

    MD5

    6efec4fe065077c392e1120651c5ade3

    SHA1

    a91599da0dcff1fcaa4343d843bf0014343ca495

    SHA256

    f4fdce21e557b8331c336196234c8df67acf2ff5b0253f66fcc05f4e0c7fca24

    SHA512

    731eef029bba88c9ecdd666ef7146b4331d78cc4c0a7b3acfa95ce2f3b706e36c6609dff52e3855e6e84024d017a52f44163b49e6bffe95d587a6885d8d7a78a

  • C:\Users\Admin\AppData\Local\Temp\Cab565C.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\QHComHelper.inf

    Filesize

    235B

    MD5

    e6e1621900168f67b7822bcefeceb80f

    SHA1

    5ca21d6e465ed8df5159e0a38d125cac0daafdbc

    SHA256

    75cf96523bdae2e83d6695177301a8b44a6dbbfa924e77dac65c42ae218a6cf2

    SHA512

    0060e6412a44014dbb6ab15452c002abfabd6acc8e12fc507a964652665894f40c28588d4dbc4cb68801de634e164dba0008cf007c387f6b32811135018e6419

  • C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • C:\Users\Admin\AppData\Local\Temp\Tar569D.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • \Program Files (x86)\DouTu\DouTuDaShi.exe

    Filesize

    1.0MB

    MD5

    1348b2ee09b0b51707a2769dfe85e15a

    SHA1

    3c3542933f37bfec4cbe7b939f659548655258bd

    SHA256

    653c229856a8ff5c7f847b0f9da94853330aa3f97a23a5cabb324682909cd091

    SHA512

    676567c5427b56dfe585ebdb628993564e9be00ce995e17cb536339914bff2cdd86f403a73b1f277e2d13048cdd89b11d129ad79c24e7e68d1a71cb3c853e717

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • \Windows\Downloaded Program Files\QHComHelper.ocx

    Filesize

    371KB

    MD5

    f83a6f606724f1d2698c90609fe9bfaa

    SHA1

    01c05f2ad45c4750b991247b9acefd5f2af12393

    SHA256

    da86fb23804a6d2150d14609310e0154ee0dcafbac431743ab077a8faeb78aa0

    SHA512

    de9b1ab94821721f6854c95327c20646a0f05f8c179574cef07ef9d06878410bfe6cdc45654065b50e1890baa61542d2fcd8f9f87c450dde8ce4b2709d709819

  • memory/1140-446-0x0000000000400000-0x0000000000639000-memory.dmp

    Filesize

    2.2MB

  • memory/1140-0-0x0000000000400000-0x0000000000639000-memory.dmp

    Filesize

    2.2MB

  • memory/2592-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB