Analysis
-
max time kernel
130s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 14:54
Static task
static1
Behavioral task
behavioral1
Sample
09f7e968376ea4a0ec8a8edc1281ad3d884f34b251c225e0cae5fa10cb7b2707_JC.vbs
Resource
win7-20230831-en
General
-
Target
09f7e968376ea4a0ec8a8edc1281ad3d884f34b251c225e0cae5fa10cb7b2707_JC.vbs
-
Size
1012KB
-
MD5
9eaa1622ab48ad3e59135969f0da985e
-
SHA1
1532cd774d5bc0150a85e211eb95729a972c90f8
-
SHA256
09f7e968376ea4a0ec8a8edc1281ad3d884f34b251c225e0cae5fa10cb7b2707
-
SHA512
2a85ef5554f3501412ede07a1bd92a4b6c33febbd6de67902777f12409c8d3c0413f8a7d030714e90e9aee09bfc9b030ac38ed38d1d604a0be84bf79ac86888c
-
SSDEEP
6144:CrbQo8oMwqz+YRrGfxsvzoi257gMYgzRlq5+mCxSp15NYxY3LCCExcnH8CoikfWT:t/P7W1kNgSz9zVGq1cqGW8cR
Malware Config
Extracted
icedid
361893872
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 13 2988 rundll32.exe 15 2988 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 2576 regsvr32.exe 2988 rundll32.exe 2988 rundll32.exe 2988 rundll32.exe 2988 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\CLSID\{42703548-2101-70A1-5CF1-5EE12D0C33D9} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\CLSID\{42703548-2101-70A1-5CF1-5EE12D0C33D9}\ = 51265b1a0eb51c1f86aa009746c70fb2d4b5a3690639094c5b9518102110668236a050a70d293d34eeba2da3bd266246e8f1cb8ee430921ce92a781c095dcd94117afd17cd91d1fa2e09f1feef87d4a7b1528296109758a30f579b369bcfbd33f777d3862e69197c533173bd3dae82d962f614c31bcb0f9410e51513f7cf154653d6e16fa7c46c09a41b7ebf12e57e3ecf8605213fdd80e4146432d465827024c8920635739d076e2843545bc51a7d3c43830865b4de235e5526b26e5e5bd89aba432eea8da31a61b68b18f3f763299603db03a47434ca907b857426c913c5d5e3d5a4931e6e25cdf862a807a3783d500c38da13452226c21dfd6922070c79574bb00c65a78ba70b2ea7095a0fba9b3455dafa4c rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 2576 regsvr32.exe 2576 regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
WScript.exeregsvr32.execmd.exedescription pid process target process PID 1692 wrote to memory of 2576 1692 WScript.exe regsvr32.exe PID 1692 wrote to memory of 2576 1692 WScript.exe regsvr32.exe PID 1692 wrote to memory of 2576 1692 WScript.exe regsvr32.exe PID 1692 wrote to memory of 2576 1692 WScript.exe regsvr32.exe PID 1692 wrote to memory of 2576 1692 WScript.exe regsvr32.exe PID 2576 wrote to memory of 2008 2576 regsvr32.exe cmd.exe PID 2576 wrote to memory of 2008 2576 regsvr32.exe cmd.exe PID 2576 wrote to memory of 2008 2576 regsvr32.exe cmd.exe PID 2008 wrote to memory of 2988 2008 cmd.exe rundll32.exe PID 2008 wrote to memory of 2988 2008 cmd.exe rundll32.exe PID 2008 wrote to memory of 2988 2008 cmd.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09f7e968376ea4a0ec8a8edc1281ad3d884f34b251c225e0cae5fa10cb7b2707_JC.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C://windows/Temp/0375-1.dll2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Roaming\{E3DC5144-E49E-273E-14B4-8C1C0C1BAAE7}\yiilacoo.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Roaming\{E3DC5144-E49E-273E-14B4-8C1C0C1BAAE7}\yiilacoo.dll,#14⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies registry class
PID:2988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575e0edf4fd8095705dbc6814a19b3d14
SHA144e3e26147efb878d95ebfd2fbe84502025c3557
SHA2566bf45fa268c80f4dbeab61978f9985a4fdac45cb89e8eed6d94c53a1dc7c296f
SHA51270977ba41f577f01183c892f768c343968f52986de0930f379c689b9b3fdab8acbfcfc76f1cdda230feb49059626b728b0c00e1872646697c6b3fb0b11c875e6
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
328KB
MD59cb1387574f53e20050989a53b152113
SHA1faa86f01bdd50e90d5e4affec6280e68be45ac95
SHA2568ea4a0e3b78209a6bb72148af0bbbcad3aeb604433ff336e42a224d453e7edef
SHA51221f34e62a23ab144a89dc91b54bced12f0d2d2ab2430e9eb142f23dca4b140e6e54379b722dcd6a705460a29d9159f1437362b0c35eff3794dedb4ef6027a320
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
328KB
MD59cb1387574f53e20050989a53b152113
SHA1faa86f01bdd50e90d5e4affec6280e68be45ac95
SHA2568ea4a0e3b78209a6bb72148af0bbbcad3aeb604433ff336e42a224d453e7edef
SHA51221f34e62a23ab144a89dc91b54bced12f0d2d2ab2430e9eb142f23dca4b140e6e54379b722dcd6a705460a29d9159f1437362b0c35eff3794dedb4ef6027a320