Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 03:49

General

  • Target

    2024-10-01_7b7f19d6d192923fbd6f91878d7a9370_icedid_nymaim.exe

  • Size

    2.7MB

  • MD5

    7b7f19d6d192923fbd6f91878d7a9370

  • SHA1

    d7b269bb4a6994b0e96daaaa96fe4b540136bdaf

  • SHA256

    de3b549c955350b574bf9074cacedb097b0a7195e065a59cf7a77295b3726fe1

  • SHA512

    3b66bcb7fece93e1a8bb736931cefd9caf05e50b1751da69ec63504134b3f565c48d6ba096e38e4fcec4bbb8cfb31653710a4d9eab6c741b0db626783f93edca

  • SSDEEP

    49152:MzewFQU04nOSem7VjKtnbVkjuuNw6tLf:MzB0SOStj2kF5N

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 3 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-01_7b7f19d6d192923fbd6f91878d7a9370_icedid_nymaim.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-01_7b7f19d6d192923fbd6f91878d7a9370_icedid_nymaim.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\SysWOW64\regini.exe
      regini.exe C:\Users\Admin\AppData\Local\Temp\ppxxxx
      2⤵
      • Modifies system executable filetype association
      • Modifies registry class
      PID:2576
    • C:\Users\Admin\AppData\Local\Temp\conhost.exe
      C:\Users\Admin\AppData\Local\Temp\conhost.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3020
      • C:\Windows\SysWOW64\regini.exe
        regini.exe C:\Users\Admin\AppData\Local\Temp\ppxxxx
        3⤵
        • Modifies registry class
        PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c C:\Users\Admin\AppData\Local\Temp\must.bat
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2584
        • C:\Windows\SysWOW64\net.exe
          net user
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2052
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2180
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2476
        • C:\Windows\SysWOW64\net.exe
          net start
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2500
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -ano
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Connections Discovery
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:2384
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2084
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers network information
          PID:1964
        • C:\Windows\SysWOW64\ARP.EXE
          arp -a
          4⤵
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          PID:2936
        • C:\Windows\SysWOW64\systeminfo.exe
          systeminfo
          4⤵
          • System Location Discovery: System Language Discovery
          • Gathers system information
          PID:2940
        • C:\Windows\SysWOW64\net.exe
          net use
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2536
        • C:\Windows\SysWOW64\net.exe
          net view
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:1444
        • C:\Windows\SysWOW64\net.exe
          net view /domain
          4⤵
          • System Location Discovery: System Language Discovery
          • Discovers systems in the same network
          PID:1308
        • C:\Windows\SysWOW64\net.exe
          net user /domain
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2624
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 user /domain
            5⤵
            • System Location Discovery: System Language Discovery
            PID:940
      • C:\Windows\SysWOW64\regini.exe
        regini.exe C:\Users\Admin\AppData\Local\Temp\ppxxxx
        3⤵
          PID:1228

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\must.bat

      Filesize

      562B

      MD5

      def72a2e815d36d1b207e69c53a0dfb6

      SHA1

      08c091cafbc4627d3e1953adeed04a4c0791f755

      SHA256

      f71e998458a6ffbf157edd7c4d7bf5dcf2df92f769f459b1adb901e13d5d2a00

      SHA512

      7c5755b82d4320000cc84bc1fdb1fdff2c4244b0849ee4eebc0529a9757e73cd1b3878255571ad00f0855ffc82dac4d6d43dc28e0b32151d4a97a122b81ab9ce

    • C:\Users\Admin\AppData\Local\Temp\ppxxxx

      Filesize

      135B

      MD5

      15e7eafedbdbb2788c5fde53e9d045e3

      SHA1

      b868931638b4b3ea9c44821e7ade2ffd3255ef2b

      SHA256

      4f1c84c3f30c5f8be30326254148b597568c0ce6ad45bd8fbddc6c9600505361

      SHA512

      e0f21948299de152d17f6f8fd49d01223d19ce605ba77b5896d200e58abfcf49241c949b38120e84aa329d5469ac69067466d81c5260db741cfdcbcf4f0c0423

    • C:\Users\Admin\AppData\Local\Temp\ppxxxx

      Filesize

      70B

      MD5

      20eb0bd9744f943aff13206338fdfca8

      SHA1

      b2f64c9fddeee998f2c52b9685c87fdaeed768fe

      SHA256

      6efe03d7c079a715fa4b6bcd52332f08b1f89e840c10a220adfe7b8318626613

      SHA512

      b674ac8a06a11be27bfac4a12785d0b85b8bc42f70ac519df0150d940914135cdd42450103131ef276be7e27a7213a3d640dead3168cf2e6cef8ccf7e2ddbb64

    • C:\Users\Admin\AppData\Local\Temp\winword4.doc

      Filesize

      10KB

      MD5

      30cee1b7c487f04a821b55b7a6ccc753

      SHA1

      f370a605c6f514e80a09a0d622b035e21bea1ff7

      SHA256

      77d09d6e938cd3cebfab7136554c04acb272b8e2f361309de19226ac7200ce2d

      SHA512

      5e50072e517c13eb6618da4c32620d6ce3e855c26f1e9b200d9d62120c516611acdd3cb685ae4b4b54b43d64c423282f9ff2bf66048739ab716b16b31db82438

    • \Users\Admin\AppData\Local\Temp\conhost.exe

      Filesize

      2.7MB

      MD5

      7b7f19d6d192923fbd6f91878d7a9370

      SHA1

      d7b269bb4a6994b0e96daaaa96fe4b540136bdaf

      SHA256

      de3b549c955350b574bf9074cacedb097b0a7195e065a59cf7a77295b3726fe1

      SHA512

      3b66bcb7fece93e1a8bb736931cefd9caf05e50b1751da69ec63504134b3f565c48d6ba096e38e4fcec4bbb8cfb31653710a4d9eab6c741b0db626783f93edca

    • memory/1200-0-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/1200-7-0x0000000000260000-0x0000000000288000-memory.dmp

      Filesize

      160KB

    • memory/1200-12-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3020-49-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB