Analysis

  • max time kernel
    2706s
  • max time network
    2591s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2023, 16:52

General

  • Target

    ICARCUS_Evil_Worm_Full-main.zip

  • Size

    34.4MB

  • MD5

    90fb1980ef2b425e55da9caf844effe5

  • SHA1

    37353ee009fc9ed6986a7921101acc58b5bd4429

  • SHA256

    bef9c74d9661d20a87f3ef487ca025be5cfd3abf8ec334ecb595f3d0cd660a27

  • SHA512

    d344bd0e024989fc662d6add5f5aa03d8cdbff2aeaec542076a407c6582c4f50a63e600558edb8918a2b430e60338a69f566b3932030029b4747711d2b0a808e

  • SSDEEP

    786432:Zj0DNnx2+SNYKlNdoubW3DORuv/w+S76yY8msglhChEvaMR/QJc9/b7VUMnCA24E:10DNnxVSiWADzOEHwpN6sglhC6AJclPu

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ICARCUS_Evil_Worm_Full-main.zip
    1⤵
      PID:4920
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:444
      • C:\Users\Admin\Desktop\ICARCUS_Evil_Worm_Full-main\IcarusEvilWorm_iPwn.exe
        "C:\Users\Admin\Desktop\ICARCUS_Evil_Worm_Full-main\IcarusEvilWorm_iPwn.exe"
        1⤵
          PID:3416
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3600
        • C:\Users\Admin\Desktop\ICARCUS_Evil_Worm_Full-main\IcarusEvilWorm_iPwn.exe
          "C:\Users\Admin\Desktop\ICARCUS_Evil_Worm_Full-main\IcarusEvilWorm_iPwn.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 C:\Users\Admin\Desktop\ICARCUS_Evil_Worm_Full-main\Plugins\Chat.dll:CheckIntegrity Self 42e3fda3c2ea2f16d7bc4c338860ac28
            2⤵
              PID:4332
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 1312
              2⤵
              • Program crash
              PID:4164
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3836 -ip 3836
            1⤵
              PID:388
            • C:\Windows\system32\rundll32.exe
              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
              1⤵
                PID:2296
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3324

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

                Filesize

                16KB

                MD5

                d1a542b72cf105da5ad3cf1e60379380

                SHA1

                65f5045bb5d27d885a47a23c53485373273979e6

                SHA256

                84da9bec7d045f71ea99ddf684e0f41f239df6595885f7b16e0e8d7cb3e8c703

                SHA512

                84774bc8ca5608bbb0a76615dca29180aa1aa432ba5728d072eba937949e5dd6243889b2877c3a3acb8e97916cb8df7ae93526a67701f216b19482072875ef59

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IcarusEvilWorm_iPwn.exe.log

                Filesize

                1KB

                MD5

                d0813621cdc8f807e315d07581c28c48

                SHA1

                0ccbf04520bd7952a6b5c7291d5695a7de199a67

                SHA256

                9f870027745f2e032cabfee0ff863a7d0f29f9d05146b12292100115325ac7ba

                SHA512

                4d551caa6ff0dac2cdac8195046e7ecf90ae008c5b42e432d7e52c5a98f3370916a8d912607cbc49811b778093e8173a9032671a82f5f068d4f05184691cc426

              • memory/3324-68-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-70-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-66-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-98-0x000001A6763D0000-0x000001A6763D1000-memory.dmp

                Filesize

                4KB

              • memory/3324-97-0x000001A6762C0000-0x000001A6762C1000-memory.dmp

                Filesize

                4KB

              • memory/3324-96-0x000001A6762C0000-0x000001A6762C1000-memory.dmp

                Filesize

                4KB

              • memory/3324-94-0x000001A6762B0000-0x000001A6762B1000-memory.dmp

                Filesize

                4KB

              • memory/3324-65-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-82-0x000001A6760B0000-0x000001A6760B1000-memory.dmp

                Filesize

                4KB

              • memory/3324-79-0x000001A676170000-0x000001A676171000-memory.dmp

                Filesize

                4KB

              • memory/3324-64-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-76-0x000001A676180000-0x000001A676181000-memory.dmp

                Filesize

                4KB

              • memory/3324-74-0x000001A676170000-0x000001A676171000-memory.dmp

                Filesize

                4KB

              • memory/3324-63-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-62-0x000001A676530000-0x000001A676531000-memory.dmp

                Filesize

                4KB

              • memory/3324-46-0x000001A66DF40000-0x000001A66DF50000-memory.dmp

                Filesize

                64KB

              • memory/3324-67-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-73-0x000001A676180000-0x000001A676181000-memory.dmp

                Filesize

                4KB

              • memory/3324-72-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-71-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3324-30-0x000001A66DE40000-0x000001A66DE50000-memory.dmp

                Filesize

                64KB

              • memory/3324-69-0x000001A676560000-0x000001A676561000-memory.dmp

                Filesize

                4KB

              • memory/3416-1-0x0000000000900000-0x0000000000EB2000-memory.dmp

                Filesize

                5.7MB

              • memory/3416-22-0x0000000074780000-0x0000000074F30000-memory.dmp

                Filesize

                7.7MB

              • memory/3416-19-0x0000000007EF0000-0x0000000007F00000-memory.dmp

                Filesize

                64KB

              • memory/3416-3-0x0000000007D40000-0x0000000007DD2000-memory.dmp

                Filesize

                584KB

              • memory/3416-18-0x0000000007EF0000-0x0000000007F00000-memory.dmp

                Filesize

                64KB

              • memory/3416-0-0x0000000074780000-0x0000000074F30000-memory.dmp

                Filesize

                7.7MB

              • memory/3416-2-0x00000000082F0000-0x0000000008894000-memory.dmp

                Filesize

                5.6MB

              • memory/3416-4-0x0000000074780000-0x0000000074F30000-memory.dmp

                Filesize

                7.7MB

              • memory/3600-16-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-13-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-6-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-5-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-7-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-11-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-12-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-17-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-15-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3600-14-0x0000025A86760000-0x0000025A86761000-memory.dmp

                Filesize

                4KB

              • memory/3836-29-0x0000000074820000-0x0000000074FD0000-memory.dmp

                Filesize

                7.7MB

              • memory/3836-24-0x0000000074820000-0x0000000074FD0000-memory.dmp

                Filesize

                7.7MB

              • memory/3836-25-0x0000000007350000-0x0000000007360000-memory.dmp

                Filesize

                64KB

              • memory/3836-26-0x0000000009EA0000-0x0000000009EAA000-memory.dmp

                Filesize

                40KB

              • memory/3836-27-0x0000000074820000-0x0000000074FD0000-memory.dmp

                Filesize

                7.7MB

              • memory/3836-28-0x0000000007350000-0x0000000007360000-memory.dmp

                Filesize

                64KB