Analysis
-
max time kernel
95s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 16:02
Static task
static1
Behavioral task
behavioral1
Sample
8041f1d8a71c710538a31bc441cf3ba7678185fb75e6423bbf3733175f9dccf7_JC.vbs
Resource
win7-20230831-en
General
-
Target
8041f1d8a71c710538a31bc441cf3ba7678185fb75e6423bbf3733175f9dccf7_JC.vbs
-
Size
1012KB
-
MD5
064e59b3e9028c0f3973f41742dedf41
-
SHA1
bc2ee10a88735cf4f3f664093ef2a1bc922664ce
-
SHA256
8041f1d8a71c710538a31bc441cf3ba7678185fb75e6423bbf3733175f9dccf7
-
SHA512
f75152a08fe57b89dbd432eac85a6e157df7f09f63b3b2f31e4b24ea0cc809c98f5401295f88b733a7464f843c12eedb50ff1cfb4958ac3aecb5b097687cba3a
-
SSDEEP
6144:US/Pe5EE3Lt02BZDB9bmFn1kZGMdGKQ9jMHqCg/gthDDEssR+6NQ7NQKqxzTE6sP:n3mbsQG4HqC6k9jN2x6rxNCwX
Malware Config
Extracted
icedid
361893872
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 44 3096 rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation WScript.exe -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exerundll32.exepid process 4976 regsvr32.exe 3096 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\CLSID\{22C48B53-EB1E-CD28-5E74-542AA472D77E} rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000_Classes\CLSID\{22C48B53-EB1E-CD28-5E74-542AA472D77E}\ = c06fb6051a2fd7f129d6169e5931aa812ae209a668f0b4755e969ed3c1802e2e984d81ce60f60d3c62603836c63c17adf4730a2d54f83ee66c6b0744edcf14818421970afaf91dd89f609ca39e6e07fd14e3b9e2cab06a8883953a47507347b634c914aa503e73a37500d8f19fff1b12dcd106445f299ecf8453deb9ca3acca181bd8db1964daf2b354cda0deb70b51070a094e61befe9a9693dc71f07d319f96fa28ef9c9586aa1940579b409c49491bc55e16aaad7ae0141dc6100b185b90bf13fe857ea6f24c61a6537c39faf17af6628d5cf1aeb6c21b0e99ebb883256eddfe39f374cb991a71573b112a67bbf91ed0b5257a7f349ce63a48c311ff8dfa49527d6f6f1f0fdeebdfd7c331cc08ebd0a0c4f27 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
regsvr32.exepid process 4976 regsvr32.exe 4976 regsvr32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
WScript.exeregsvr32.execmd.exedescription pid process target process PID 1540 wrote to memory of 4976 1540 WScript.exe regsvr32.exe PID 1540 wrote to memory of 4976 1540 WScript.exe regsvr32.exe PID 4976 wrote to memory of 4952 4976 regsvr32.exe cmd.exe PID 4976 wrote to memory of 4952 4976 regsvr32.exe cmd.exe PID 4952 wrote to memory of 3096 4952 cmd.exe rundll32.exe PID 4952 wrote to memory of 3096 4952 cmd.exe rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8041f1d8a71c710538a31bc441cf3ba7678185fb75e6423bbf3733175f9dccf7_JC.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C://windows/Temp/0022-1.dll2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C rundll32.exe C:\Users\Admin\AppData\Local\{5F9A09C9-354A-1192-1E64-3ABEBD5661E7}\{69E7EB9B-A9F4-C548-8CC2-9D3C7055F34E}\ehyiacsk.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\{5F9A09C9-354A-1192-1E64-3ABEBD5661E7}\{69E7EB9B-A9F4-C548-8CC2-9D3C7055F34E}\ehyiacsk.dll,#14⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies registry class
PID:3096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\{5F9A09C9-354A-1192-1E64-3ABEBD5661E7}\{69E7EB9B-A9F4-C548-8CC2-9D3C7055F34E}\ehyiacsk.dll
Filesize556KB
MD5002c64d47bf8c0878ac8ec2b4740f682
SHA1acc44c89420270083de7d67b025748a4b98071ed
SHA256b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA51280f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd
-
C:\Users\Admin\AppData\Local\{5F9A09C9-354A-1192-1E64-3ABEBD5661E7}\{69E7EB9B-A9F4-C548-8CC2-9D3C7055F34E}\ehyiacsk.dll
Filesize556KB
MD5002c64d47bf8c0878ac8ec2b4740f682
SHA1acc44c89420270083de7d67b025748a4b98071ed
SHA256b4f17e438636e166a94b2cd7c83e1c2b3cf1184122b6204521c1024e293ba8b1
SHA51280f44373c7dc7a08d94b65e1f830e6d922ae9b8fefca5beadaf6a1a8c33622219da404bed11daeb7de03f1b3432782a11cd019ff814b981b9e6885066666affd
-
Filesize
328KB
MD5518feb430bc216a4a3240ebd246c0a88
SHA15e692a03d01874e33376e85ab5d51840adbe5ed8
SHA2563366a497c8c9a44557612b96cf49f307b10e4f1857dd622d1ffc1246bf4dae91
SHA512a771b15c5daf9e6abcacf13364ae17a00e648735df3fa47d7dfb50bcded55f7b3cbe03f145cb40e0233a49ef99077166823e5fcea7c7c286bbf7d17bed7cc39a
-
Filesize
328KB
MD5518feb430bc216a4a3240ebd246c0a88
SHA15e692a03d01874e33376e85ab5d51840adbe5ed8
SHA2563366a497c8c9a44557612b96cf49f307b10e4f1857dd622d1ffc1246bf4dae91
SHA512a771b15c5daf9e6abcacf13364ae17a00e648735df3fa47d7dfb50bcded55f7b3cbe03f145cb40e0233a49ef99077166823e5fcea7c7c286bbf7d17bed7cc39a