Analysis
-
max time kernel
146s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12-10-2023 14:55
Static task
static1
Behavioral task
behavioral1
Sample
0aac9c2f0650d572c11b03ac3ad1a3abc981fc9eef3682ebdc17d0a2bb9e2c7e_JC.vbs
Resource
win7-20230831-en
General
-
Target
0aac9c2f0650d572c11b03ac3ad1a3abc981fc9eef3682ebdc17d0a2bb9e2c7e_JC.vbs
-
Size
1012KB
-
MD5
b067d01ed850c7ab59e9c5ff8d62f30e
-
SHA1
e529df02ce5c37176a5befe9f52d5f2b880510e9
-
SHA256
0aac9c2f0650d572c11b03ac3ad1a3abc981fc9eef3682ebdc17d0a2bb9e2c7e
-
SHA512
dd9233fb0bc992963f467f8dee16dbc639aab4b164178552a138633a21e09a71f3cc68c3ea6e2b1ae0234784a19d6041b6bb03495956677cf18d630ce8c8f338
-
SSDEEP
6144:Fs9phl54PN1TsOeXfR+D06ucjJ6MJOu/P5XUbMhj2xppOVi7tYZmiOkag187u04F:saxpZhkbMxMKUlHRmouOGUkTg21
Malware Config
Extracted
icedid
361893872
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 8 2560 rundll32.exe 14 2560 rundll32.exe -
Loads dropped DLL 5 IoCs
Processes:
regsvr32.exerundll32.exepid process 3068 regsvr32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe 2560 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 3068 regsvr32.exe 3068 regsvr32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
WScript.exeregsvr32.execmd.exedescription pid process target process PID 2176 wrote to memory of 3068 2176 WScript.exe regsvr32.exe PID 2176 wrote to memory of 3068 2176 WScript.exe regsvr32.exe PID 2176 wrote to memory of 3068 2176 WScript.exe regsvr32.exe PID 2176 wrote to memory of 3068 2176 WScript.exe regsvr32.exe PID 2176 wrote to memory of 3068 2176 WScript.exe regsvr32.exe PID 3068 wrote to memory of 2480 3068 regsvr32.exe cmd.exe PID 3068 wrote to memory of 2480 3068 regsvr32.exe cmd.exe PID 3068 wrote to memory of 2480 3068 regsvr32.exe cmd.exe PID 2480 wrote to memory of 2560 2480 cmd.exe rundll32.exe PID 2480 wrote to memory of 2560 2480 cmd.exe rundll32.exe PID 2480 wrote to memory of 2560 2480 cmd.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0aac9c2f0650d572c11b03ac3ad1a3abc981fc9eef3682ebdc17d0a2bb9e2c7e_JC.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C://windows/Temp/0492-1.dll2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Local\Admin\itqacoaccd.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Admin\itqacoaccd.dll,#14⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5698fb5149113edc1910849960f60dd3b
SHA1c1c3580d4e47d437b446886e9735cd1a70de1c6c
SHA256fa397b9500175d0193d0bf9ba466d5d350e0300752574c990e52ace13958f69d
SHA512902f8ed6cbb2d2217fa79aa217c74e7f55ab6d40217cbabdfa5643c724d1dab6fc7f5c0110f7b0fb5b0abe866585a8246b18c639560543f83d6090e11bbdbe59
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
328KB
MD5bfec3494adddbbf4305e55cc3f9c106c
SHA1ae431c2c72e89eb65ad28f1ff9f09a6629683d25
SHA2566081c50f00781636c59d48afe9e9c3d4e3040223e22ad2440b6aa37b649730ef
SHA5127fa4e0f676cd9f12079c947bf831a9dcdbd46528f2c96eec5d404a440e16dbf46f67fa9e4c997e41c89907d7969f1f93abfdaad090ed6e6ecb54a26fc132e52f
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
583KB
MD50245e02cbb6ffe2716c2aeb7fb8006d0
SHA159dd3d2477211eb4fcd72b542812a2036fa0e1e8
SHA2565d5bc4f497406b59369901b9a79e1e9d1e0a690c0b2e803f4fbfcb391bcfeef1
SHA5120c2e863512f2d83429e681cbcdb31bf9c6f0a69611f6d8923198d51d1e49750f4bf441c8ce256fb44a9cb39a6855e70fcbc644739926570214400bd06a683d82
-
Filesize
328KB
MD5bfec3494adddbbf4305e55cc3f9c106c
SHA1ae431c2c72e89eb65ad28f1ff9f09a6629683d25
SHA2566081c50f00781636c59d48afe9e9c3d4e3040223e22ad2440b6aa37b649730ef
SHA5127fa4e0f676cd9f12079c947bf831a9dcdbd46528f2c96eec5d404a440e16dbf46f67fa9e4c997e41c89907d7969f1f93abfdaad090ed6e6ecb54a26fc132e52f